nextcloud / nextcloud/richdocuments
Cross-Origin-Opener-Policy breaks other nextcloud apps
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 453
- Forks
- 147
- Avg merge
- 14h 54m
- Merged PRs (30d)
- 83
Description
Describe the bug
enabling Nextcloud Office breaks other nextcloud apps
To Reproduce
Steps to reproduce the behavior:
- Enable Nextcloud Office 8.5.1
- Click on maps or memories
- maps: tiles are not loaded, memories: preview is not displayed, pictures are not loaded
Expected behavior
Other nextcloud apps should work
Screenshots
-
e.g no preview in memories
-
e.g no tiles in maps
Client details:
- OS: windows 11, android, android memories app
- Firefox 131, Edge 129
- Device: desktop, android, nextcloud apps
Server details
Operating system: dietpi 9.7
Web server: nginx 1.22.1
Database: MariaDB
PHP version: PHP 8.2.24
Nextcloud version: 29 & 30
Version of the richdocuments app: Nextcloud Office 8.5.1
Browser log
mistakes:
The source list for the Content Security Policy directive 'connect-src' contains an invalid source: '://'. It will be ignored.
c.tile.openstreetmap.org/11/1086/692.png:1
GET https://c.tile.openstreetmap.org/11/1086/692.png net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep 200 (OK)
Hit F12 to open developer tools, switch to Network tab, reload page with F5. At the top of the request list, select maps/, then select "Headers" tab in the newly opened frame.
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener Policy: same-origin
Discovery and possible root cause
discovery
possible root cause with explanation by MichaIng
same? failure was mentioned [here] (https://github.com/nextcloud/richdocuments/pull/3260)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin with the maps/ request in the browser Network tools and inspect the Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy headers. Read the linked richdocuments issue 3258 and PR 3260, then compare behavior with Nextcloud Office enabled in Maps and Memories. Done means tiles, previews, and pictures load normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100