跪拜 Guibai
← All articles
Backend · Java · Programmer

Embedding OnlyOffice in Spring Boot for In-Browser Word and Excel Editing

By SimonKing ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Teams that already run Spring Boot services can add browser-based Office editing without reaching for Google Docs APIs or Microsoft 365 cloud dependencies. OnlyOffice's Community Edition is free and self-hosted, so document data stays on your own infrastructure.

Summary

The integration runs OnlyOffice's Community Edition Docker image and wires it to a Spring Boot backend that handles file upload, download via one-time tokens, and save callbacks. Two plain HTML pages — a file manager and an editor host — load the OnlyOffice frontend SDK dynamically, turning any DOCX, XLSX, or PPTX file into an editable browser session.

A JWT signing step, using the Nimbus library, secures the configuration payload passed to the document server. The callback endpoint listens for status 2 (document ready for saving) and status 6 (editing finished), then fetches the updated file from OnlyOffice and overwrites local storage. File type detection and content-type mapping are handled through simple extension-based switch expressions.

The whole setup — Docker run command, Maven dependencies, controller code, and frontend HTML — fits into a single walkthrough. The result is a self-contained online Office editor that persists edits without external storage services.

Takeaways
— OnlyOffice Document Server runs as a standalone Docker container and exposes an API that a Spring Boot app calls to generate editor configs.
— JWT authentication is enabled by default in the Docker image; the secret can be retrieved from inside the container and used to sign config payloads with HS256.
— Files are served to OnlyOffice through a one-time download token mapped to the original filename, avoiding direct file path exposure.
— The callback endpoint checks for status codes 2 and 6 before downloading the edited file from OnlyOffice and replacing the local copy.
— Frontend integration requires only loading the api.js script from the document server and calling DocsAPI.DocEditor with the signed config object.
— File type routing (word, cell, slide) is determined by extension, and content types are mapped for DOCX, XLSX, PPTX, and PDF.
Conclusions

The integration deliberately avoids a database — file state lives on disk and token-to-filename mappings sit in an in-memory map, which works for a single-instance demo but would break across multiple app nodes without shared storage.

Using a static JWT secret hardcoded in a constants class is expedient for a tutorial but skips any discussion of secret rotation or environment-based configuration, which a production deployment would need.

The callback handler writes the downloaded file to a .tmp path first and then moves it into place, a small atomicity detail that prevents serving a partially written file if the download fails mid-stream.

Concepts & terms
OnlyOffice Document Server
An open-source web service that renders Office files (DOCX, XLSX, PPTX) in a browser-based editor and provides APIs for configuration, document loading, and save callbacks.
JWT signing in OnlyOffice config
The JSON configuration object passed to the OnlyOffice editor can be signed with a shared secret using HS256. The document server verifies this signature to ensure the config hasn't been tampered with.
Callback status 2 and 6
OnlyOffice sends a POST to the callback URL with a status field. Status 2 means the document is ready for saving; status 6 means editing has finished. Both trigger a file download from the document server.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗