Mobile App "400 Bad Request" / "Cannot download file" with Traefik & Files Containing Spaces

Seafile Server
1

If you are using Traefik as your reverse proxy and have recently updated, you may find that the Seafile Mobile App (iOS/Android) fails to download or preview files that contain spaces in their names, while the Web Browser works perfectly.

The Issue

The Seafile Mobile app and the Web Browser use different APIs to retrieve files.

  • The Browser uses the “Repo” endpoint. It encodes a space as %20.

  • The Mobile App uses the “Files” (Token) endpoint. Perhaps for reasons related to how the app handles internal tokens, it double-encodes spaces. A space becomes %20, and then the % is encoded again, resulting in %2520.

Recent security updates in Traefik (specifically PR #12360) introduced a filter that blocks encoded percent signs (%25) by default to prevent URI injection attacks. This causes Traefik to drop the mobile request before it even reaches your Seafile container.

Log Comparison

1. Browser Request (Working)

The browser sends a single-encoded URL. Traefik accepts this and passes it to the backend.

Plaintext

traefik | 10.64.0.1 - - [23/Dec/2025:10:00:00 +0000] "GET /seafhttp/repos/123-abc/Document%20With%20Space.pdf HTTP/2.0" 200 512400 "https://sf.example.com/"

2. Mobile App Request (Failing)

The mobile app sends a double-encoded URL. Note the %2520. Traefik returns a 400 Bad Request and does not forward the request to the backend (indicated by the - at the end of the log).

Plaintext

traefik | 10.64.0.1 - - [23/Dec/2025:10:05:00 +0000] "GET /seafhttp/files/456-def/Document%2520With%2520Space.pdf HTTP/2.0" 400 0 "-" "-"

The Fix

To allow the mobile app to function with recent Traefik versions, you must explicitly allow the encoded percent sign in your Traefik configuration (command line flags or traefik.yml).

If using Docker Compose: Add the following flag to your Traefik service:

services:
  traefik:
    image: traefik:latest
    command:
      - "--entrypoints.websecure.http.encodedCharacters.allowEncodedPercent=true"
      # ... other flags

If using traefik.yml:

entryPoints:
  websecure:
    http:
      encodedCharacters:
        allowEncodedPercent: true

Suggestions for Seafile Developers

While the Traefik fix works, this issue highlights a discrepancy between the Seafile clients:

  1. Consistency: It would be ideal if the Mobile App utilized the same URL encoding logic as the Web/Desktop clients to avoid being flagged by modern security filters.

  2. Endpoint Alignment: If the Mobile App could use the standard /seafhttp/repos/ pathing where possible, it would benefit from the more robust handling already present in the web interface.

2 Likes
2

Thank for reporting the issue. We will take a lot at it.

3

Thank you for this! I was wondering why some files were failing to download on my iOS clients. They all contained spaces and this fix resolved the issue.