# WOPI Documentation on security is a bit unclear to me

**URL:** <https://help.nextcloud.com/t/wopi-documentation-on-security-is-a-bit-unclear-to-me/234654>\
**Category:** ℹ️ Support\
**Tags:** wopi, collabora-online, documentation\
**Created:** [October 25, 2025, 12:56pm UTC](https://help.nextcloud.com/t/wopi-documentation-on-security-is-a-bit-unclear-to-me/234654 "2025-10-25T12:56:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![theking2](https://help.nextcloud.com/user_avatar/help.nextcloud.com/theking2/32/78496_2.png) [@theking2](https://help.nextcloud.com/u/theking2)\
**Post date:** [October 25, 2025, 12:56pm UTC](https://help.nextcloud.com/t/wopi-documentation-on-security-is-a-bit-unclear-to-me/234654/1 "2025-10-25T12:56:09Z")

</div>

I try to understand what I read [here](https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#secure-view-settings).

- **WOPI configuration** is the same as **Wopi settings**. Is this intentional?
- The text

> Similarly, it is advised to configure [Collabora’s WOPI host configuration](https://sdk.collaboraonline.com/docs/installation/Configuration.html#multihost-configuration) to only serve IPs from expected hosts.

is not very clear to me. What is meant by _expected hosts_? Are those clients, the nextcloud server or the Collabora server?

As this in a section on security I believe it to be absolutely clear what is meant here.

---

<div class="post-metadata">

**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\
**Post date:** [October 25, 2025, 1:17pm UTC](https://help.nextcloud.com/t/wopi-documentation-on-security-is-a-bit-unclear-to-me/234654/2 "2025-10-25T13:17:46Z")

</div>

as you didn’t ask a clear question I try to rephrase

Nextcloud docs:

> [Wopi settings](https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings)
> 
> It is highly recommended to restrict WOPI requests to the IP addresses of the Collabora servers that are expected to request files from the Nextcloud installation. This can be done by setting the `Allow list for WOPI requests` option from the Office admin settings.
> 
> Similarly, it is advised to configure [Collabora’s WOPI host configuration](https://sdk.collaboraonline.com/docs/installation/Configuration.html#multihost-configuration) to only serve IPs from expected hosts.

state you should restrict WOPI to known host using #wopi_allowlist and refer to [Collabora’s WOPI host configuration](https://sdk.collaboraonline.com/docs/installation/Configuration.html#multihost-configuration) to adjust security on the COOL/CODE side. where do you struggle or what is unclear?

please review the [Collabora integration guide](https://help.nextcloud.com/t/collabora-integration-guide/151879) to understand the WOPI protocol and the integration

---

<div class="post-metadata">

**Author:** ![theking2](https://help.nextcloud.com/user_avatar/help.nextcloud.com/theking2/32/78496_2.png) [@theking2](https://help.nextcloud.com/u/theking2)\
**Post date:** [October 27, 2025, 7:40pm UTC](https://help.nextcloud.com/t/wopi-documentation-on-security-is-a-bit-unclear-to-me/234654/3 "2025-10-27T19:40:54Z")

</div>

> [@theking2](#):
>
> What is meant by _expected hosts_? Are those clients, the nextcloud server or the Collabora server?

Sorry about that. For clarity

> In other words should there be IP-adresses or hostnames of the expected clients? The IP-address or hostname of the WOPI server?

---

<div class="post-metadata">

**Author:** ![system](https://help.nextcloud.com/user_avatar/help.nextcloud.com/system/32/29333_2.png) [@system](https://help.nextcloud.com/u/system)\
**Post date:** [January 25, 2026, 7:41pm UTC](https://help.nextcloud.com/t/wopi-documentation-on-security-is-a-bit-unclear-to-me/234654/4 "2026-01-25T19:41:03Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.