The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →An ownCloud redirect loop almost always means the URL your browser uses does not match the URL ownCloud infers from its connection. The mismatch can be the scheme (http versus https), hostname, port, or webroot path. Correct the first changing part of the redirect chain, explicitly trust the reverse proxy, and whitelist the public hostname. Do not change several URL settings at once: capture the chain, make one targeted correction, clear cached redirects, and test again.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an ownCloud redirect loop means
Every request has several URL dimensions: protocol, host, port, and path. A browser may request https://cloud.example.com/owncloud, while the ownCloud process behind a proxy sees an ordinary HTTP request to an internal address such as http://10.0.0.20/. If ownCloud or the proxy tries to “correct” that perceived URL, the response can point back to the first URL. The browser then repeats the exchange indefinitely.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The same thing happens when two components enforce different canonical URLs. For example, a proxy may redirect HTTP to HTTPS while ownCloud believes the original request was already HTTPS, or a proxy may publish /owncloud while the backend generates links at the site root.
What changes in each Location header |
Likely cause | Primary correction |
|---|---|---|
http and https alternate |
TLS ends at a proxy, but ownCloud does not receive or trust the forwarded protocol | Send the correct forwarded protocol and set overwriteprotocol when automatic detection is wrong |
| Public and internal hostnames alternate | The public host is not being preserved, or a competing canonical redirect is active | Set overwritehost to the public host and remove the competing redirect |
Ports alternate, such as :443 and :8443 |
The proxy’s external port differs from the backend’s perceived port | Include the public non-default port in overwritehost and align proxy headers |
/owncloud is repeatedly added or removed |
Proxy path mapping and ownCloud webroot disagree | Set overwritewebroot to the externally visible path and fix the mapping |
| The host is rejected as untrusted | The exact hostname or IP is absent from trusted_domains |
Add every URL host used by readers; update the container environment when using Docker |
Capture the redirect chain before changing configuration
Do not guess which component is responsible. First record every redirect target. Use a header-only request from a machine that can reach the public address:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
curl -I -L https://cloud.example.com/Replace the example address with the exact URL users enter. In the output, record each Location value in order. The browser gives the same information in its developer tools: open the Network panel, load the page with “Preserve log” enabled, and inspect each request’s response headers.
- Write down the first URL and the first URL dimension that changes: scheme, host or port, or path.
- Check whether the change is made by the proxy, web server, or ownCloud. The
Serverheader and each hop’s address can help, but logs are more reliable. - Save a copy of
config/config.phpbefore editing it. - Correct only the identified dimension, then repeat the same request.
A cached permanent redirect can make a fixed server appear broken. After each change, test with a private browser window and with the header request. If a normal window still loops while the private window works, clear cached redirects and site data for the affected host.
Stop HTTP/HTTPS alternation when TLS terminates at a proxy
In a common deployment, the reverse proxy accepts HTTPS from the internet and sends plain HTTP to the ownCloud web server. That backend connection is not evidence that the public request was HTTP. The proxy must pass the public protocol, and ownCloud must trust the proxy that supplies it.
Forward the public protocol
Ensure the proxy sends the public Host and an X-Forwarded-Proto (or equivalent forwarded) value of https for an HTTPS request. A typical Nginx proxy location includes directives like these:
location /owncloud/ {
proxy_pass http://10.0.0.20/owncloud/;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}The upstream address and path must match your deployment; the example is not a universal copy-and-paste configuration. If the proxy itself receives HTTP and redirects it to HTTPS, make sure the HTTPS request reaches the location above with $scheme equal to https.
Tell ownCloud the externally visible scheme
When automatic detection still produces HTTP links, add:
Recommended Free Tools
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
'overwriteprotocol' => 'https',This controls the protocol ownCloud uses when generating URLs. It does not replace a required proxy redirect, and it should not be set to HTTPS if users genuinely access the service over HTTP.
Avoid two conflicting HTTPS rules
Use one deliberate HTTP-to-HTTPS policy. Two independent rules—one at the proxy and another at the backend—can issue redirects that disagree about the original request. Remove or align the rule that points to an internal hostname, an unexpected port, or a different path.
Fix hostname and port changes
The public host must survive every hop. Set the proxy’s host header to the host requested by the client, and make sure the backend does not generate a different canonical name. If automatic detection cannot determine the public value, set overwritehost:
'overwritehost' => 'cloud.example.com',For a public service on a non-default port, include that port in the value, for example 'overwritehost' => 'cloud.example.com:8443'. Use the port users actually enter, not the internal listening port.
Inspect the chain for a second canonicalization rule in the proxy or web server. A redirect from cloud.example.com to an internal server name, or from :443 to :8443, will continue even after ownCloud is configured correctly. Remove the competing rule or make both components use the same public URL.
Fix a webroot mismatch
A root deployment publishes ownCloud at https://cloud.example.com/. A subdirectory deployment publishes it at a path such as https://cloud.example.com/owncloud. The value in overwritewebroot must match the path visible to the browser, including the leading slash:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
'overwritewebroot' => '/owncloud',For a root deployment, do not set overwritewebroot to /owncloud; omit the setting unless another documented path override is required.
Apache path mapping
When Apache is the reverse proxy, the external and internal paths must be paired. The official pattern uses both ProxyPass and ProxyPassReverse:
ProxyPass /domain.tld/owncloud http://10.0.0.20/owncloud
ProxyPassReverse /domain.tld/owncloud http://10.0.0.20/owncloudUse your real public path and upstream address. Omitting ProxyPassReverse can allow backend redirects to expose an internal URL, while mapping only one side of the path can cause /owncloud to be repeatedly added or removed.
Check trailing slashes and prefixes
Compare the path in the browser’s first request, the proxy’s upstream URL, and the value generated in each Location. A redirect from /owncloud to /owncloud/ can be normal; a repeating alternation between the two indicates that the proxy and backend disagree about slash handling. Keep one consistent mapping and retest before changing other settings.
Trust the reverse proxy without trusting everyone
Forwarded headers are security-sensitive. ownCloud’s administration guidance requires you to explicitly identify the proxy servers it should trust. Put only the proxy addresses in trusted_proxies:
'trusted_proxies' => ['10.0.0.10'],Do not add an arbitrary network “just to make it work.” If untrusted clients can supply forwarded headers, they may be able to spoof their apparent address or influence URL generation.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
If overwrite behavior should apply only when requests arrive through one proxy, use overwritecondaddr with a regular expression matching that proxy’s address. For example:
'overwritecondaddr' => '^10.0.0.10$',Use the address that actually connects to ownCloud. In a multi-proxy setup, list and match the intended ingress addresses rather than the entire private address space.
Add every public host to trusted_domains
All hostnames and IP addresses used to reach the server must be explicitly whitelisted. Add the exact public name users enter:
'trusted_domains' => [
'cloud.example.com',
],If users legitimately use more than one hostname or an IP address, include each one. Treat aliases separately; trusting cloud.example.com does not automatically trust another alias. Keep the list limited to addresses you intend to serve.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An untrusted-host error is different from a pure protocol loop, but the two often appear together after a proxy migration. Resolve the trusted-domain error first, then capture the redirect chain again so that an old cached response does not hide the next problem.
Docker-specific settings
In Docker deployments, the container’s environment commonly supplies the trusted host list. Set OWNCLOUD_TRUSTED_DOMAINS to a comma-separated list when more than one value is needed. If that variable is undefined, the migration documentation says ownCloud uses OWNCLOUD_DOMAIN instead.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
OWNCLOUD_TRUSTED_DOMAINS=cloud.example.com,cloud.example.netUse the environment mechanism supported by your compose file or deployment system, then verify the effective value inside the running container. Restart the service after changing environment variables; editing the host’s shell environment does not alter an already running container.
Docker does not remove the need for correct proxy headers. The container still needs to receive the public host and protocol, and its own configuration still needs the correct overwrite values when automatic detection fails.
A complete configuration pattern
The following illustrates a subdirectory deployment behind a proxy at 10.0.0.10. Replace every example value with the addresses and URL users actually use:
// config/config.php
$CONFIG = [
'trusted_proxies' => ['10.0.0.10'],
'trusted_domains' => ['cloud.example.com'],
'overwritehost' => 'cloud.example.com',
'overwriteprotocol' => 'https',
'overwritewebroot' => '/owncloud',
'overwrite.cli.url' => 'https://cloud.example.com/owncloud',
];Do not add all of these keys automatically. A root deployment does not need overwritewebroot, and a server that terminates TLS itself may not need overwriteprotocol. The correct values are the ones that match the URL in the browser and the headers arriving at ownCloud.
Why overwrite.cli.url matters
overwrite.cli.url is the full base URL used by cron jobs and links generated through occ. If it points to another domain, command-line tasks can send users to the wrong host and require another login even after the web redirect is fixed. Keep its scheme, host, port, and path identical to the public base URL.
Compare the two common deployment choices
| Decision | Option 1 | Option 2 | What must agree |
|---|---|---|---|
| TLS termination | Reverse proxy terminates HTTPS and forwards HTTP | OwnCloud web server terminates HTTPS | With proxy termination, forwarded protocol and trusted_proxies are essential; with backend termination, the backend must see the real HTTPS connection |
| Public path | Root: / |
Subdirectory: /owncloud |
Proxy mapping, generated links, and overwritewebroot must use the same path |
| Overwrite policy | Static values such as overwritehost and overwriteprotocol |
Conditional values controlled by overwritecondaddr |
Static values suit one stable public entry point; conditional values limit overrides to known proxy addresses |
There is no universally superior arrangement. Choose the one that reflects the URL users actually enter and the headers the proxy actually sends. A technically valid setting for one arrangement can create a loop when copied to the other.
Free tools Windows power users keep installed
One-click scans. No signup required.
A safe repair sequence
- Back up
config/config.phpand save the current redirect chain. - Identify the first changing dimension: scheme, host or port, or webroot path.
- Correct the proxy header or the matching ownCloud overwrite setting for that dimension.
- Confirm that only the intended proxy addresses appear in
trusted_proxies. - Add the exact public hostname or IP to
trusted_domains; in Docker, updateOWNCLOUD_TRUSTED_DOMAINSor, when it is unset,OWNCLOUD_DOMAIN. - Restart the relevant service when configuration or container environment changes require it.
- Test with a private browser window and repeat the header request. Confirm that every
Locationnow moves toward one final URL. - If the chain still changes, inspect ownCloud, proxy, and web-server logs at the same time and look for the component issuing the first unexpected redirect.
Common failed fixes and how to recover
- Only clearing cookies: This cannot correct a server-side scheme, host, port, or path mismatch. Use a private window to separate browser cache effects from configuration errors.
- Setting every overwrite key: Unnecessary overrides can create a new mismatch. Remove keys that do not describe the public deployment and change one dimension at a time.
- Trusting every proxy address: A broad network entry weakens forwarded-header protections. Restrict
trusted_proxiesto actual ingress addresses. - Fixing ownCloud but leaving the proxy redirect: A proxy that still redirects to an internal host or port will reintroduce the loop. Inspect its canonical-host and HTTP-to-HTTPS rules.
- Changing the container variable without restarting: A running container keeps its old environment. Verify the effective value inside the container and restart the service.
- Using the internal URL in
overwrite.cli.url: Web requests may work while cron orocc-generated links send users elsewhere. Set the complete public URL instead.
When the browser keeps returning to the login page
Start with the same redirect-chain test rather than assuming a password or account problem. If the chain alternates hosts, protocols, ports, or paths, fix that URL mismatch first. A browser that is sent between two versions of the site can repeatedly arrive at a login endpoint without ever retaining a stable public origin. Once the chain ends at one canonical URL, test a fresh private session; if the issue remains without redirects, use the application and web-server logs to investigate authentication separately.
Quick Recap
Final verification checklist
- The browser’s first URL is the intended public scheme, host, port, and path.
- Each proxy hop preserves the public
Hostand sends the correct forwarded protocol. trusted_proxiescontains only the proxy addresses that should be trusted.trusted_domainscontains every hostname or IP that users actually use.overwritehost,overwriteprotocol, andoverwritewebroot—when present—match the externally visible URL.- Apache path deployments use both
ProxyPassandProxyPassReversewith the same public mapping. - Docker environment changes have been applied by restarting the service.
- A private-window load and a fresh header request reach one final URL without alternating
Locationvalues.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
