WebSocket connection fails on some documents due to connecting to port 8484 on a Grist instance behind a reverse proxy

Author: swazynskiCreated Sep 11, 2026Updated Sep 14, 2026

Describe the problem

After a recent update (exact version is sadly not known), the browser logs the following upon opening some documents:

Mixed Content: The page at 'https://grist.example.com/docid/Untitled-document' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://grist.example.com:8484/dw/0/v/unknown/o/example-org?clientId=fe57239520f16888&counter=112&newClient=1&browserSettings=%7B%22timezone%22%3A%22Europe%2FBerlin%22%7D&user=&doc=docid'. This request has been blocked; this endpoint must be available over WSS.

(this the output of Chrome, Firefox behaves the same but gives a slightly different error message).

For documents that do work, the wss connection makes more sense, as it is successfully connected to:

wss://grist.example.com/dw/self/v/unknown/o/swdec?clientId=0&counter=17&newClient=1&browserSettings={"timezone":"Europe/Berlin"}&user=&doc=docid2

I do not know why it succeeds for one document and fails to connect for another. The problem seems irrespective of how old the document is (i.e. created before or after the upgrade), since creating new documents fails with some probability (two-thirds in my tests). Once a document does open, it repeatedly opens, same for failing documents. This seems to persist for most documents across server restarts. However, the Grist documents themselves (.grist files in Grist's storage) do open fine in another instance (tested on Grist cloud).

The following variables are set in the Grist docker container:

REDIS_URL=redis://redis-regular
GRIST_WIDGET_LIST_URL=https://github.com/gristlabs/grist-widget/releases/download/latest/manifest.json
TYPEORM_PASSWORD=grist
GRIST_OIDC_SP_IGNORE_EMAIL_VERIFIED=true
GRIST_HELP_CENTER=https://help.example.com
HOSTNAME=grist
TYPEORM_USERNAME=grist
NODE_OPTIONS=--no-deprecation --disable-proto=delete
GRIST_ORG_CREATION_ANYONE=false
GRIST_FORCE_LOGIN=false
YARN_VERSION=1.22.22
GRIST_TELEMETRY_LEVEL=off
GRIST_DOCKER_GROUP=grist
PWD=/grist
GRIST_PAGE_TITLE_SUFFIX= - SWD-EC
GRIST_DOCS_MINIO_ENDPOINT=minio-regular
NODE_ENV=production
GRIST_BOOT_KEY=redacted
GRIST_SANDBOX_FLAVOR=gvisor
GVISOR_FLAGS=-unprivileged -ignore-cgroups
GRIST_DOCKER_USER=grist
HOME=/root
GRIST_DATA_DIR=/persist/docs
GRIST_INST_DIR=/persist
TYPEORM_HOST=db-regular
GRIST_DOCS_MINIO_USE_SSL=0
GRIST_DOCS_MINIO_BUCKET=grist-docs
GRIST_DOCS_MINIO_PORT=9000
GRIST_ORG_IN_PATH=true
[email protected]
GRIST_OIDC_IDP_ENABLED_PROTECTIONS=NONCE,STATE
GRIST_ALLOW_AUTOMATIC_VERSION_CHECKING=true
TERM=xterm
GRIST_OIDC_SP_PROFILE_NAME_ATTR=name
GRIST_DOCS_MINIO_ACCESS_KEY=grist
GRIST_OIDC_IDP_ISSUER=https://auth.example.com
TYPEORM_DATABASE=grist-home
GRIST_PERSONAL_ORGS=false
TYPEORM_TYPE=postgres
SHLVL=1
GRIST_EXT_FULL_EDITION_BASE_URL=https://grist-static.com/grist-full-edition
APP_HOME_URL=https://grist.example.com
GRIST_SESSION_COOKIE=grist_core
GRIST_SERVE_SAME_ORIGIN=true
GRIST_OIDC_IDP_CLIENT_SECRET=redacted
GRIST_OIDC_SP_PROFILE_EMAIL_ATTR=email
GRIST_OIDC_SP_HOST=https://grist.example.com
GRIST_SESSION_SECRET=redacted
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
GRIST_SINGLE_ORG=example-org
GRIST_HIDE_UI_ELEMENTS=billing,templates,multiSite,multiAccounts,sendToDrive,tutorials,supportGrist
GRIST_DOCS_MINIO_SECRET_KEY=redacted
GRIST_OIDC_IDP_CLIENT_ID=redacted
NODE_VERSION=22.23.2
DEBUG=1
GRIST_HOST=0.0.0.0
GRIST_DEFAULT_LOCALE=de
APP_STATIC_INCLUDE_CUSTOM_CSS=true
GRIST_EXTERNAL_ATTACHMENTS_MODE=snapshots

It runs behind Caddy, the only configuration being:

grist.example.com {
  reverse_proxy grist-regular:8484
}

Additional information

Grist version: 1.7.19
Grist instance URL: - (self-hosted)
SSO solution used and its version (if relevant): not relevant
S3 storage solution and its version (if relevant): minio version RELEASE.2025-09-07T16-13-09Z (commit-id=07c3a429bfed433e49018cb0f78a52145d4bedeb)
Docker version (if relevant):
NodeJS version (if relevant):
Redis version (if relevant):
PostgreSQL version (if relevant):

Source: gristlabs/grist-core

View original on GitHub View discussion on GitHub