WebAppPassword

Nextcloud App Store | Releases | Old releases | Changelog | Report issues

This is a Nextcloud app to generate a temporary app password and set CORS headers to allow WebDAV/CalDAV, Share API and Preview access from inside a webpage.

Place this app in nextcloud/apps/ or install it from the Nextcloud App Store.

Configuration

You can configure the allowed origins for both WebDAV/CalDAV or files sharing api on the settings page of the application.

Alternatively you can also add this setting to your config/config.php (it will be used if the origins setting on the settings page are empty).

'webapppassword.origins' => ['https://example.com'], - array of allowed webdav/caldav origins

Origins must include the scheme, host and optional port. Paths are ignored. One-level subdomain wildcards are supported in the host as https://*.example.com. This matches https://app.example.com, but not https://a.b.example.com and not https://example.com. Add the apex origin separately if it should also be allowed. The scheme and port still need to match, so https://*.example.com does not allow http://app.example.com.

The setting is both used for the origin of the CORS headers for the WebDAV/CalDAV requests and for the referrer check whether we want to generate a temporary app password.

Also, you can configure in the same way the files sharing part.

'webapppassword.files_sharing_origins' => ['https://example.com'], - array of allowed files sharing api origins

Under the hood it exposes parts of the sharing api (CRUD and the preflight OPTIONS endpoint) in this url: https://example.com/index.php/apps/webapppassword/api/v1/shares

Also, you can configure in the same way the files preview part.

'webapppassword.preview_origins' => ['https://example.com'], - array of allowed preview api origins

Under the hood it exposes parts of the preview api (get and the preflight OPTIONS endpoint) in this url: https://example.com/index.php/apps/webapppassword/core/preview

Docker

You can use this container for development and testing of the application.

cd docker
docker compose build
docker compose up

• http://localhost:8081 admin/admin
• (first time only) For the origin config see WEBPASSWORD_ORIGINS in docker-compose.yml

Update the admin screenshot

In the devenv development shell, run:

just screenshot

This starts the Docker app, waits for Nextcloud, logs in as admin/admin, and replaces screenshot.png with a headless Chromium capture of the WebAppPassword admin settings in English. Example origins are filled in without saving them. The Docker instance is left running. Playwright and Chromium are provided by the development shell; no browser installation is needed.

If Nextcloud reports a pending upgrade, upgrade the development instance first with just upgrade. The screenshot recipe does not perform database upgrades automatically.

For an existing instance with different credentials, set SCREENSHOT_URL, SCREENSHOT_USER, and SCREENSHOT_PASSWORD. To capture it without starting Docker, run python3 scripts/screenshot-admin.py directly.

Commit and push screenshot.png to main to update the image URL already referenced in appinfo/info.xml for the Nextcloud App Store (subject to its caching).

Example

You can start a php server with cd docs/example && php -S localhost:8082 to see an example page on http://localhost:8082/.

If you have started the docker container you can log in to your Nextcloud container with admin/admin and receive a temporary app password for your user.

There also is the FileSource component of our Nextcloud file picker in the example.

Take a look at index.html for the source code of the page.

Running tests

You can use the provided Makefile to run all tests by using:

cd docker && make test

Generate translation

You will need the translationtool to generate the translation files for all languages.

php /path/to/translationtool.phar convert-po-files

See: Manual translation

Releasing

See Signing and releasing for the GitHub Actions setup, Nextcloud signing credentials, automated release procedure and recovery steps.

References

This Nextcloud application is used in the [NextcloudFilePicker]https://github.com/digital-blueprint/toolkit/blob/main/packages/file-handling/src/nextcloud-file-picker.js) web component to generate temporary app passwords and to allow WebDAV-access from inside the web browser.

---

This project is tested with BrowserStack.