Troubleshooting - Sophos Firewall encoded slashes¶

If you are using a Sophos Firewall, you might run into this:

Problem:¶

• Nextcloud and Nextcloud Office (Collabora) are running, but when you open a file in Nextcloud, Collabora opens but shows the error "Failed to establish socket connection or socket connection closed unexpectedly. The reverse proxy might be misconfigured, please contact the administrator. For more info on proxy configuration please checkout https://sdk.collaboraonline.com/docs/installation/Proxy_settings.html"
• Proxy settings are correct
• https://portal.nextcloud.com/article/Frequently-Asked-Questions/Document-loading-failed-behind-a-firewall did not help
• turns out, the problem is that Sophos Firewall cannot handle encoded slashes:

Known Issue NC-159041 “Webpages with Encoded Slashes Not Allowed“ https://docs.sophos.com/support/kil/index.html

Non-standard Webpages Not loading With WAF.

If there any encoded slashes in the URL responsible for Loading the Web pages those URL would not load and are replied with 404 by WAF although the resource exists on the backend server. The signs for identifying such an URI is it contains slashes in encoded format (%2F) The Apache directive AllowEncodedSlashes is set to No by default for security reasons. This means Apache will reply with a 404 to every request containing encoded slashes. Setting the parameter to NoDecode is not an option since that setting is not compatible with mod_proxy since it would result in double encoding. The reason why the encoded slashes are not allowed is that you can access locations that were otherwise restricted. E.g. if you have a location configured for /something on example.com and you access example.com/something%2F..%2Fadmin, you can reach a location that might have no site path configured in WAF. This is for setting AllowEncodedSlashes to yes. More information would be at https://httpd.apache.org/docs/2.4/mod/core.html#allowencodedslashes

No workaround stated.

Solution:¶

Add this to your coolwsd.xml file:

<hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false">true</hexify_embedded_urls>