Joplin Server behind Nginx + home router custom HTTPS port gives “Invalid origin”

[zhuhaid]

Operating system

Linux

Joplin version

1.22.22

What issue do you have?

Hello Joplin Team,

I am trying to set up Joplin Server behind Nginx on a home network using a custom HTTPS port. I keep running into an “Invalid origin” issue and cannot access the web interface properly.

Environment:
• Joplin Server: latest Docker image
• PostgreSQL: 15 Docker image
• Docker host: Synology NAS (DSM)
• Joplin Server exposed on internal IP: 172.16.1.200:22300
• Nginx reverse proxy with HTTPS: https://<YOUR_DOMAIN>:18443
• APP_BASE_URL inside container: https://<YOUR_DOMAIN>:18443
• Router forwards external port 18443 to NAS
• Accessing https://<YOUR_DOMAIN>:18443 gives either:
• Invalid origin: http://<YOUR_DOMAIN>
• Or 502 Bad Gateway

What I tried:
1. Set APP_BASE_URL inside container to https://<YOUR_DOMAIN>:18443
2. Tried with and without the port in APP_BASE_URL
3. Configured Nginx with standard reverse proxy headers, including X-Forwarded-Host and X-Forwarded-Proto
4. Tried using curl to access the server, always got Invalid origin
5. Checked container logs, nothing indicates server error
6. Verified Joplin server container is running and listening on 22300docker run -d
--name joplin-server
-e APP_BASE_URL=https://<YOUR_DOMAIN>:18443
-e DB_CLIENT=pg
-e POSTGRES_HOST=db
-e POSTGRES_USER=joplin
-e POSTGRES_PASSWORD=joplin
-e POSTGRES_DATABASE=joplin
-p 22300:22300
joplin/server:latest

Nginx config snippet:
server {
listen 18443 ssl;
server_name <YOUR_DOMAIN>;

ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/privkey.pem;

location / {
    proxy_pass http://172.16.1.200:22300;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

}

Problem:
• The login page partially loads if APP_BASE_URL does not include port 18443, but submitting password fails
• With port included, always Invalid origin
• The server seems to reject requests because the origin header does not match APP_BASE_URL

Questions:
1. How should I set APP_BASE_URL correctly when using a non-standard HTTPS port behind a reverse proxy?
2. Are there any special headers or Nginx configurations required for Joplin Server to accept requests through a home router port?
3. Could this be a Docker image version issue or something specific to OpenResty / Nginx?

Any guidance would be greatly appreciated.

Thank you!

[MoriarT3a]

Hello zhuhaid,

I’ve set the app port via environment variable. Did you try this?

    app:
        image: joplin/server:latest
        container_name: joplin
        depends_on:
            - db
        ports:
            - "22300:22300"
        restart: always
        environment:
            - APP_PORT=22300
            - APP_BASE_URL=https://joplin.xxx.de
            - DB_CLIENT=pg
            - POSTGRES_PASSWORD=password
            - POSTGRES_DATABASE=joplin
            - POSTGRES_USER=joplin
            - POSTGRES_PORT=5432
            - POSTGRES_HOST=db

I’m not really shure if this is the right option for this, because I’m using the standart ports. But maybe this works.

And a little additon: I've set Host to http_host on nginx. But there I also don't know if it helps you. But sometimes trying is better then nothing.

location / {
    proxy_pass http://xxx.xxx.xxx.xxx:22300;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Greetings!