No file sharing from web

[qmarty-ccc]

Hi, I've set up prosody and I am able to join MUC and exchange text and files (plain and encrypted) from clients such Pidgin, Dino-im and Gajim. The xmpp-web offers a very cool interface platform-independent and am running it on the same server of prosody ( not docker because of the i386 arch ) : as for now I managed to use everything listed above except the file sharing :
I get :
11:42:22.023 XHRPUT
https://myserver:5281/file_share/ebc26c56-204e-4923-9cc8-83fd7b71b434/gjat.jpg
[HTTP/1.1 401 Unauthorized 208ms]

then a OPTION call to the uploaded file (code 200)

and finally :
11:30:05.263 httpUpload
Object { message: "Request failed with status code 401", name: "AxiosError", code: "ERR_BAD_REQUEST", config: {…}, request: XMLHttpRequest, response: {…}, status: 401, stack: "", … }
index-126f0889.js:89:38276
postFile https://myserver/assets/index-126f0889.js:89
sendMessage https://myserver/assets/index-126f0889.js:89
Mk/C[6]< https://myserver/assets/index-126f0889.js:89
n https://myserver/assets/index-126f0889.js:17
Ni https://myserver/assets/index-126f0889.js:13
ke https://myserver/assets/index-126f0889.js:13
e https://myserver/assets/index-126f0889.js:17
(Async: EventListener.handleEvent)
Xe https://myserver/assets/index-126f0889.js:17
p2 https://myserver/assets/index-126f0889.js:17
y2 https://myserver/assets/index-126f0889.js:17
hA https://myserver/assets/index-126f0889.js:13
Y https://myserver/assets/index-126f0889.js:13
v https://myserver/assets/index-126f0889.js:13
cA https://myserver/assets/index-126f0889.js:13
hA https://myserver/assets/index-126f0889.js:13
Y https://myserver/assets/index-126f0889.js:13
v https://myserver/assets/index-126f0889.js:13
dA https://myserver/assets/index-126f0889.js:13
run https://myserver/assets/index-126f0889.js:9
M https://myserver/assets/index-126f0889.js:13
V https://myserver/assets/index-126f0889.js:13
W https://myserver/assets/index-126f0889.js:13
v https://myserver/assets/index-126f0889.js:13
cA https://myserver/assets/index-126f0889.js:13
hA https://myserver/assets/index-126f0889.js:13
Y https://myserver/assets/index-126f0889.js:13
v https://myserver/assets/index-126f0889.js:13
dA https://myserver/assets/index-126f0889.js:13
run https://myserver/assets/index-126f0889.js:9
M https://myserver/assets/index-126f0889.js:13
V https://myserver/assets/index-126f0889.js:13
W https://myserver/assets/index-126f0889.js:13
v https://myserver/assets/index-126f0889.js:13
dA https://myserver/assets/index-126f0889.js:13
run https://myserver/assets/index-126f0889.js:9
M https://myserver/assets/index-126f0889.js:13
V https://myserver/assets/index-126f0889.js:13

I've tried switching options in local.js and asking myself if it isn't maybe missing similarly to defaultDoman and defaultMuc, "defaultFile_sharing" or something? the sso :{ ... } stuff also is not clear what's used for and if it can be of any use in this case.
Anybody experienced this ?
Thanks

[nioc]

Hello @qmarty-ccc may be related to this issue.

Which prosody version?

[qmarty-ccc]

I've checked the link ( thanks ) but trying those config the issue is transferred from the PUT (err 401) to the OPTION call :
12:37:16.161 XHROPTIONS
https://myserver:5281/file_share/18623849-3b5f-4507-8d1a-ee5acf78f516/gjat.jpg
CORS Missing Allow Header

[nioc]

As I said in issue I do not have 0.12, but it seems like there is some Prosody config about CORS.

[nioc]

Using a reverse proxy(nginx, HAProxy,…) for exposing both prosody socket and XMPP web on same domain/port should solve your issue.

[qmarty-ccc]

👍 thank you, I'll try to play with those CORS settings
-- For the upload component access_control_allow_methods = { "GET", "OPTIONS", "PUT" } access_control_allow_headers = true access_control_allow_credentials = {"content-type"} access_control_allow_origins = { "*" } access_control_max_age = 7200 consider_websocket_secure = true http_cors_override = { bosh = { enabled = true; }; websocket = { enabled = true; }; }
I cannot install anything else : the server has 500 Mb RAM and 900 Mb left on disk

[nioc]

Keep us informed if you found a solution.
I'm still with a 0.11 Prosody, which was simpler to setup… as a final workaround, you can downgrade.

[qmarty-ccc]

All right, I've wasted few hours and this is a CORS nightmare (https://jub0bs.com/posts/2023-02-08-fearless-cors/) , no way to pass that crap simply tuning server and client. There must be some magic with reverse proxy and additional middleware/bloadware . Thank you anyway for the quick replies and support ! 🏅

[qmarty-ccc]

curl -X OPTIONS -H "Origin: https://pmyserver" -H "Access-Control-Request-Method: PUT" -H "Access-Control-Request-Headers: content-type, authorization" -I https://myserver:5281/file_share/test
returns this :
HTTP/1.1 200 OK
Content-Length: 0
Connection: Keep-Alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://myserver
Access-Control-Allow-Methods: GET, OPTIONS, PUT
Date: Sat, 30 Aug 2025 12:57:03 GMT
Access-Control-Max-Age: 7200
Access-Control-Allow-Headers: authorization,x-csrf-token, Authorization

being the error : "Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response."
Due to this https://stackoverflow.com/questions/32500073/request-header-field-access-control-allow-headers-is-not-allowed-by-itself-in-pr I understand that somewhere the client is not responding with the expected headers for CORS ( which should be the ones above "