跪拜 Guibai
← All articles
Backend · Java · Programmer

Embedding OnlyOffice in Spring Boot for In-Browser Word and Excel Editing

By SimonKing ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Teams that already run Spring Boot services can add browser-based Office editing without reaching for Google Docs APIs or Microsoft 365 cloud dependencies. OnlyOffice's Community Edition is free and self-hosted, so document data stays on your own infrastructure.

Summary

The integration runs OnlyOffice's Community Edition Docker image and wires it to a Spring Boot backend that handles file upload, download via one-time tokens, and save callbacks. Two plain HTML pages — a file manager and an editor host — load the OnlyOffice frontend SDK dynamically, turning any DOCX, XLSX, or PPTX file into an editable browser session.

A JWT signing step, using the Nimbus library, secures the configuration payload passed to the document server. The callback endpoint listens for status 2 (document ready for saving) and status 6 (editing finished), then fetches the updated file from OnlyOffice and overwrites local storage. File type detection and content-type mapping are handled through simple extension-based switch expressions.

The whole setup — Docker run command, Maven dependencies, controller code, and frontend HTML — fits into a single walkthrough. The result is a self-contained online Office editor that persists edits without external storage services.

Takeaways
OnlyOffice Document Server runs as a standalone Docker container and exposes an API that a Spring Boot app calls to generate editor configs.
JWT authentication is enabled by default in the Docker image; the secret can be retrieved from inside the container and used to sign config payloads with HS256.
Files are served to OnlyOffice through a one-time download token mapped to the original filename, avoiding direct file path exposure.
The callback endpoint checks for status codes 2 and 6 before downloading the edited file from OnlyOffice and replacing the local copy.
Frontend integration requires only loading the api.js script from the document server and calling DocsAPI.DocEditor with the signed config object.
File type routing (word, cell, slide) is determined by extension, and content types are mapped for DOCX, XLSX, PPTX, and PDF.
Conclusions

The integration deliberately avoids a database — file state lives on disk and token-to-filename mappings sit in an in-memory map, which works for a single-instance demo but would break across multiple app nodes without shared storage.

Using a static JWT secret hardcoded in a constants class is expedient for a tutorial but skips any discussion of secret rotation or environment-based configuration, which a production deployment would need.

The callback handler writes the downloaded file to a .tmp path first and then moves it into place, a small atomicity detail that prevents serving a partially written file if the download fails mid-stream.

Concepts & terms
OnlyOffice Document Server
An open-source web service that renders Office files (DOCX, XLSX, PPTX) in a browser-based editor and provides APIs for configuration, document loading, and save callbacks.
JWT signing in OnlyOffice config
The JSON configuration object passed to the OnlyOffice editor can be signed with a shared secret using HS256. The document server verifies this signature to ensure the config hasn't been tampered with.
Callback status 2 and 6
OnlyOffice sends a POST to the callback URL with a status field. Status 2 means the document is ready for saving; status 6 means editing has finished. Both trigger a file download from the document server.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗