nextcloud / nextcloud/richdocuments

Cross-Origin-Opener-Policy breaks other nextcloud apps

Open
#4,103 11 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
453
Forks
147
Avg merge
14h 54m
Merged PRs (30d)
83

Description

Describe the bug
enabling Nextcloud Office breaks other nextcloud apps

To Reproduce
Steps to reproduce the behavior:

  1. Enable Nextcloud Office 8.5.1
  2. Click on maps or memories
  3. maps: tiles are not loaded, memories: preview is not displayed, pictures are not loaded

Expected behavior
Other nextcloud apps should work

Screenshots

  • e.g no preview in memories Image

  • e.g no tiles in maps

Image

Client details:

  • OS: windows 11, android, android memories app
  • Firefox 131, Edge 129
  • Device: desktop, android, nextcloud apps
Server details

Operating system: dietpi 9.7

Web server: nginx 1.22.1

Database: MariaDB

PHP version: PHP 8.2.24

Nextcloud version: 29 & 30

Version of the richdocuments app: Nextcloud Office 8.5.1

Browser log
mistakes:

    The source list for the Content Security Policy directive 'connect-src' contains an invalid source: '://'. It will be ignored.

    c.tile.openstreetmap.org/11/1086/692.png:1

        GET https://c.tile.openstreetmap.org/11/1086/692.png net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep 200 (OK)

Hit F12 to open developer tools, switch to Network tab, reload page with F5. At the top of the request list, select maps/, then select "Headers" tab in the newly opened frame.

Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener Policy: same-origin

Discovery and possible root cause

discovery
possible root cause with explanation by MichaIng
same? failure was mentioned [here] (https://github.com/nextcloud/richdocuments/pull/3260)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Begin with the maps/ request in the browser Network tools and inspect the Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy headers. Read the linked richdocuments issue 3258 and PR 3260, then compare behavior with Nextcloud Office enabled in Maps and Memories. Done means tiles, previews, and pictures load normally.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.