Description
In July I wanted to update from cryptpad 2025.03.0 to cryptpad 2025.06.0. After some usual shenanigans, I managed to get cryptpad up and running again. Except that I cannot go further than the file-view! I can view a previous form, but not anything related to onlyoffice.
The first error I see in my console is this:
Refused to load the script 'http://cryptpad.mydomain.com/extensions.js/?ver=2025.6.0-1752853763496' because it violates the following Content Security Policy directive: "script-src 'self' resource: https://cryptpad.mydomain.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
Steps to reproduce
- I'm using a docker-compose.yaml script to run the docker-image from
cryptpad/cryptpad:version-2025.6.0 together with an nginx using the configuration in https://github.com/cryptpad/cryptpad/blob/main/docs/example-advanced.nginx.conf
- All this is behind a traefik proxy, so the nginx only sees http traffic
- I removed all SSL-related configuration from the advanced.nginx.conf
- I also tried to add
proxy_set_header X-Forwarded-Proto https; to the nginx.conf, which didn't help
Relevant logs
Refused to load the script 'http://cryptpad.mydomain.com/extensions.js/?ver=2025.6.0-1752853763496' because it violates the following Content Security Policy directive: "script-src 'self' resource: https://cryptpad.mydomain.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
Expected behavior
I expect the file to be loaded from https:// instead of http:// - btw, if I enter http:// manually in my browser, the traefik proxy redirects to the https://, and the file shows up correctly.
Which operating system are you using?
No response
What browsers are you seeing the problem on?
No response
Extensions
None
Version
2025.6.0
