Nextcloud \"Access Through Untrusted Domain\": What It Means and the Fix That Sticks
Nextcloud only answers to the addresses on its trusted_domains list, and localhost always works, which is why the error shows up the first time you use another device. Add the exact address you type with occ config:system:set trusted_domains. In Docker, changing NEXTCLOUD_TRUSTED_DOMAINS after the first install does nothing.
"Access through untrusted domain. Please contact your administrator." Nextcloud shows this when you reach it by an address that isn't on its list of trusted domains. Nothing is broken. Add the exact address you typed in the browser to that list, on the server, and the login page comes back.
We filmed every step on a fresh Nextcloud 35.0.1 in Docker, installed the way
most Docker guides leave it: trusting localhost only.
Why does it work on the server but not from my laptop or phone?
Nextcloud always trusts localhost, 127.0.0.1 and
[::1], whatever the list says. The admin manual puts it this way: "as
long as you have access to the physical server you can always log in." So
everything works while you set it up on the server itself. The error appears the
first time you open it by its network address, from another device, or by a
domain name. In our test, with the list completely empty, 127.0.0.1
still loaded the login page.
The list is the server's own names, not the devices allowed in. The manual says it plainly: "This is not a list of allowed client-side domains or IP addresses." Adding your phone's IP does nothing.
How do I add a trusted domain?
Use occ, Nextcloud's command-line tool. First list what's there.
The entries are numbered from zero:
occ config:system:get trusted_domainsThen set the next free number to the address you type in the browser. If the list shows two entries (slots 0 and 1), use 2:
occ config:system:set trusted_domains 2 --value=192.168.1.50Reload the page. That's it; no restart is needed. How you run occ
depends on how Nextcloud is installed:
# Official Docker image (container name from `docker ps`)
docker exec -u www-data <container> php occ config:system:get trusted_domains
docker exec -u www-data <container> php occ config:system:set trusted_domains 2 --value=192.168.1.50
# Plain Linux install (run from the Nextcloud folder, e.g. /var/www/nextcloud)
sudo -u www-data php occ config:system:set trusted_domains 2 --value=192.168.1.50
# Snap
sudo nextcloud.occ config:system:set trusted_domains 2 --value=192.168.1.50You can also edit config/config.php by hand, as the error page
suggests. It works, but a typo in that file takes the whole server down, and in
Docker the file is inside your volume. If you do, the entry looks like this:
'trusted_domains' =>
array (
0 => 'localhost',
1 => '192.168.1.50',
2 => 'cloud.example.com',
),Why didn't changing NEXTCLOUD_TRUSTED_DOMAINS in Docker fix it?
Because the official image only reads that variable once, when it first
installs Nextcloud into an empty volume. It copies the addresses into
config.php, and from then on that file is the list. In our test we
recreated the container with the address added to
NEXTCLOUD_TRUSTED_DOMAINS, the same thing docker compose up
-d does after you edit the compose file. The container had the new value,
config.php did not, and the page still said "Access through untrusted
domain". The image's start-up script sets trusted domains only inside its
first-install branch. Use occ as above.
Can I just put * in the list?
Not on its own. A lone * matches every address, so the error goes
away because the check is switched off. Nextcloud's configuration reference
explains what the list is for: "Specifying trusted domains prevents host header
poisoning. Do not remove this, as it performs necessary security checks."
Nextcloud builds some links, such as the one in a password-reset email, from the
address it was reached by; the list makes sure that address is yours.
How do domain names, wildcards and ports work?
- A domain goes on the list exactly as typed:
cloud.example.com. Nohttps://: an entry written with it did not match in our test. - A star inside a name is a wildcard.
*.example.comlet incloud.example.combut notexample.comitself, so list the bare domain too if you use it. - Ports are optional. With only the IP listed, the same IP on
port 8096 was let in. Listing
host:portinstead allows only that port. - Behind a reverse proxy, it's still the name people type in
the browser. The proxy's own settings (
trusted_proxies,overwriteprotocol) are a separate job; our setup warnings guide covers the HTTPS side.
What about Nextcloud AIO?
All-in-One takes your domain when you first set it up and manages the rest
itself. Its documentation says there is currently no way to change that domain
from the AIO interface afterwards; it describes editing its
configuration.json and restarting the containers, with a backup
first. Follow
AIO's
"How to change the domain?" section rather than editing
trusted_domains by hand.
Sources
Full video transcript
1
00:00:00,000 --> 00:00:03,051
Access through untrusted
domain means one thing.
2
00:00:03,091 --> 00:00:08,074
You reached Nextcloud by an address that
isn't on its list of trusted domains.
3
00:00:08,114 --> 00:00:12,840
The fix is to add that exact address,
the one you typed, with one command.
4
00:00:12,880 --> 00:00:15,094
And if you run Nextcloud in Docker,
5
00:00:15,134 --> 00:00:18,572
changing the setting in your
compose file won't do it.
6
00:00:18,612 --> 00:00:19,771
I'll show you why.
7
00:00:20,171 --> 00:00:23,240
This is Nextcloud thirty
five, freshly installed.
8
00:00:23,280 --> 00:00:27,681
It runs in Docker, on a Linux server
I run myself, on my home network.
9
00:00:27,721 --> 00:00:30,663
I'm opening it by the
server's network address,
10
00:00:30,703 --> 00:00:34,129
the way a laptop or a phone
on the same network would.
11
00:00:35,404 --> 00:00:40,175
Access through untrusted domain.
Please contact your administrator.
12
00:00:40,215 --> 00:00:45,960
If you are an administrator, edit the
trusted domains setting in config dot php.
13
00:00:47,209 --> 00:00:48,960
Look at the address I used.
14
00:00:49,000 --> 00:00:52,808
Nextcloud keeps a list of the
addresses it will answer to.
15
00:00:52,848 --> 00:00:57,227
That list is called trusted domains.
And this address isn't on it.
16
00:00:58,485 --> 00:01:01,421
That's all this error
means. Nothing is broken.
17
00:01:01,461 --> 00:01:04,524
The fix is to add this
exact address to the list.
18
00:01:04,564 --> 00:01:08,554
There's no button for it on this
page. It's done on the server.
19
00:01:09,808 --> 00:01:11,840
Now here's the confusing part.
20
00:01:11,880 --> 00:01:15,955
Open the same Nextcloud by
localhost, on the server itself.
21
00:01:17,163 --> 00:01:22,389
Same server. Same list. But
this time, it's the login page.
22
00:01:23,624 --> 00:01:27,144
Nextcloud always trusts localhost,
whatever the list says.
23
00:01:27,184 --> 00:01:30,520
So while you set it up on
the server, everything works.
24
00:01:30,560 --> 00:01:34,142
The error waits for the first
time you use another address.
25
00:01:34,182 --> 00:01:36,760
Your laptop, your phone, or a domain name.
26
00:01:38,029 --> 00:01:40,918
The error page links
to Nextcloud's manual.
27
00:01:40,958 --> 00:01:44,432
Its section on trusted
domains says the same thing.
28
00:01:45,641 --> 00:01:49,877
The loopback addresses, like localhost,
are always treated as trusted,
29
00:01:49,917 --> 00:01:52,809
regardless of the trusted
domains configuration.
30
00:01:52,849 --> 00:01:57,309
As long as you have access to the
physical server, you can always log in.
31
00:01:58,565 --> 00:02:01,585
And one line here saves
a lot of wasted time.
32
00:02:01,625 --> 00:02:06,113
This is not a list of allowed
client-side domains or IP addresses.
33
00:02:07,353 --> 00:02:11,297
So adding your phone's address,
or your laptop's, does nothing.
34
00:02:11,337 --> 00:02:15,890
The list holds the server's own names.
The address you type to reach it.
35
00:02:18,342 --> 00:02:19,997
If you run the Docker image,
36
00:02:20,037 --> 00:02:23,689
you've probably seen a setting
for this in your compose file.
37
00:02:23,729 --> 00:02:25,263
Nextcloud trusted domains.
38
00:02:25,303 --> 00:02:29,802
So the obvious fix is to add the address
there, and recreate the container.
39
00:02:29,842 --> 00:02:33,494
That's what docker compose up
does after you change the file.
40
00:02:33,534 --> 00:02:35,227
I've just done exactly that.
41
00:02:36,507 --> 00:02:39,101
Back to the server's network address.
42
00:02:40,308 --> 00:02:45,864
The same error. The container has the
new setting. Nextcloud never read it.
43
00:02:47,109 --> 00:02:47,797
Here's why.
44
00:02:47,837 --> 00:02:52,758
The Docker image reads that setting
once, when it first installs Nextcloud.
45
00:02:52,798 --> 00:02:57,521
It copies the addresses into config
dot php, which lives in your volume.
46
00:02:57,561 --> 00:02:59,902
From then on, that file is the list.
47
00:02:59,942 --> 00:03:03,580
Changing the setting in your
compose file does nothing.
48
00:03:04,851 --> 00:03:10,057
The fix that sticks is occ, Nextcloud's
command line tool, run on the server.
49
00:03:10,097 --> 00:03:11,760
First, list what's there.
50
00:03:11,800 --> 00:03:15,780
The entries are numbered from
zero, and here there are two.
51
00:03:15,820 --> 00:03:19,323
Then set the next free
number, two, to your address.
52
00:03:19,363 --> 00:03:23,859
In Docker, run both through docker
exec, as the web server's user.
53
00:03:25,159 --> 00:03:29,340
I'll run them now. You could also
edit config dot php by hand.
54
00:03:29,380 --> 00:03:34,759
But one typo in that file takes the whole
server down, so occ is the safer way.
55
00:03:38,892 --> 00:03:43,805
Reload. And it's the login page,
at the same address as before.
56
00:03:43,845 --> 00:03:46,361
That address is now on the list.
57
00:03:47,599 --> 00:03:51,359
Sign in, and you're in,
by the network address.
58
00:03:55,123 --> 00:04:00,293
Why have a list at all? Nextcloud's
configuration reference answers that.
59
00:04:01,501 --> 00:04:05,590
Specifying trusted domains
prevents host header poisoning.
60
00:04:05,630 --> 00:04:09,972
Do not remove this, as it performs
necessary security checks.
61
00:04:11,212 --> 00:04:12,075
In plain words.
62
00:04:12,115 --> 00:04:16,170
Nextcloud builds some links, like
the one in a password reset email,
63
00:04:16,210 --> 00:04:18,278
from the address it was reached by.
64
00:04:18,318 --> 00:04:21,229
The list makes sure that
address is really yours,
65
00:04:21,269 --> 00:04:26,086
so a stranger can't get your server to
send out links that point somewhere else.
66
00:04:27,365 --> 00:04:31,518
So don't fix this error by putting
a star on its own in the list.
67
00:04:31,558 --> 00:04:36,718
A lone star matches every address. The
error goes away because the check is off.
68
00:04:37,972 --> 00:04:40,838
Domain names go on the list the same way.
69
00:04:40,878 --> 00:04:44,877
Type the name exactly, without
https, and without a port.
70
00:04:44,917 --> 00:04:49,767
The name alone covers every port.
A star inside a name is a wildcard.
71
00:04:49,807 --> 00:04:54,869
Star dot example dot com covers every
name that ends in example dot com,
72
00:04:54,909 --> 00:04:58,625
but not example dot com
itself, so list that one too.
73
00:04:58,665 --> 00:05:03,980
And behind a reverse proxy, it's still
the name people type in the browser.
74
00:05:05,925 --> 00:05:09,551
So. The address you type has
to be on Nextcloud's list.
75
00:05:09,591 --> 00:05:14,883
Localhost always works, which is why the
error shows up from your other devices.
76
00:05:14,923 --> 00:05:19,482
In Docker, the compose file setting
only counts at the first install.
77
00:05:19,522 --> 00:05:24,614
Add the address with occ, in the next
free slot. And never a star on its own.
78
00:05:24,654 --> 00:05:27,453
The commands are on the page linked below.