Nextcloud: the reverse proxy header configuration is incorrect

What the message looks like

The reverse proxy header configuration is incorrect. This is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud.

Common causes

• Nextcloud runs behind nginx, Apache, Traefik, HAProxy or a Docker proxy, but trusted_proxies is not set in config.php.
• The proxy does not send X-Forwarded-For, X-Forwarded-Proto and Host.
• overwriteprotocol or overwrite.cli.url do not match the public address (http against https).
• More than one hop, for example Cloudflare, then nginx, then the Nextcloud container, and only one of them is trusted.
• The opposite case: there is no proxy, but trusted_proxies still lists an old address.

Check

1. Which proxies does Nextcloud trust?
   sudo -u www-data php occ config:system:get trusted_proxiesCopy
2. Is the protocol forced correctly?
   sudo -u www-data php occ config:system:get overwriteprotocolCopy
3. Which headers does the proxy set?
   grep -rnE 'proxy_set_header|X-Forwarded' /etc/nginx/Copy
4. What address does the app see for you? (Settings → Administration → Overview shows the warning)
   curl -sI https://cloud.example.com/status.phpCopy

Fix

• Add the proxy's address: sudo -u www-data php occ config:system:set trusted_proxies 0 --value=192.0.2.10. Use one index per proxy.
• Force the public protocol: sudo -u www-data php occ config:system:set overwriteprotocol --value=https.
• Make the proxy send the headers: proxy_set_header Host $host;, proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; and proxy_set_header X-Forwarded-Proto $scheme;.
• Behind Cloudflare, add Cloudflare's address ranges to trusted_proxies and set forwarded_for_headers to HTTP_CF_CONNECTING_IP.
• If there is no proxy, remove trusted_proxies and forwarded_for_headers.

FAQ

Why is this called a security issue?

Nextcloud only believes the forwarded IP from trusted proxies. Otherwise anyone could send a fake header and hide behind a false address, which also defeats brute-force protection.

Why does every user show the same IP?

Because the proxy's address is what Nextcloud sees. Then the brute-force protection can throttle all users at once, see too many requests.