WopiHost

A modular WOPI host implementation for .NET that lets you plug your own data source into Office Online Server, Microsoft 365 for the Web, or any other WOPI client by implementing a small set of interfaces.

Packages

Package	What it does	Version	Downloads
WopiHost.Abstractions	Interfaces every other package builds on (IWopiStorageProvider, IWopiLockProvider, IWopiPermissionProvider, IWopiAccessTokenService)
WopiHost.Core	The WOPI server — Minimal-API endpoints, JWT auth, proof validation (AddWopi() + app.MapWopiEndpoints(), ConfigureWopiSecurity())
WopiHost.Discovery	Reads the WOPI client's discovery XML (IDiscoverer, IDiscoveryFileProvider)
WopiHost.Url	Builds the URLs you embed in iframes (WopiUrlBuilder, WopiUrlSettings)
WopiHost.FileSystemProvider	Reference storage backed by a directory tree
WopiHost.MemoryLockProvider	In-process lock store (single instance / dev)
WopiHost.AzureStorageProvider	Storage backed by Azure Blob Storage
WopiHost.AzureLockProvider	Distributed lock store backed by Azure Blob leases (strongest cross-instance exclusion)
WopiHost.RedisLockProvider	Best-effort distributed lock store backed by Redis (Lua-scripted compare-and-swap)
WopiHost.Cobalt	Optional MS-FSSHTTP support (requires Microsoft.CobaltCore, see below)	not published	—

Why use it?

• Modular architecture — selective integration via 10 dedicated NuGet packages, clean separation between protocol, storage, and locking.
• Flexible storage — implement IWopiStorageProvider to put any backend behind WOPI: file system, blob storage, database, custom APIs. See Extending WopiHost.
• Comprehensive WOPI compliance — file operations, container operations, ecosystem support, and the bootstrapper endpoint for Office mobile.
• WOPI discovery built in — dynamic capability detection from the WOPI client with template resolution and caching.
• Enterprise-ready security — WOPI proof validation, origin checking, JWT access tokens, pluggable permission/ACL providers.
• .NET Aspire integration — service orchestration, OpenTelemetry, container support out of the box.
• Optional Cobalt (MS-FSSHTTP) — for OOS clients that prefer the more efficient co-authoring protocol.

Quick start

Prerequisites

• .NET 10 SDK
• Docker Desktop (used by .NET Aspire for container resources)
• Recommended: Visual Studio 2026 with the .NET Aspire workload, or VS Code with the C# Dev Kit

Run

git clone https://github.com/petrsvihlik/WopiHost.git
cd WopiHost
dotnet run --project infra/WopiHost.AppHost

The Aspire dashboard opens automatically and starts:

Resource	What it is
wopihost	WOPI backend; OpenAPI at /scalar
wopihost-web	Sample frontend (file picker + iframe)
wopihost-validator	WOPI protocol validator
collabora	Collabora Online (CODE) container — real WOPI client for end-to-end editing

The dashboard shows the URL each resource is bound to — Aspire allocates ports dynamically for the frontends, so they change between runs. The first run pulls the collabora/code Docker image (~1 GB) and takes a minute or two; if you don't want the dependency, set "AppHost:UseCollabora": false in infra/WopiHost.AppHost/appsettings.Development.json.

Documentation

Everything beyond the basics lives in the wiki:

Topic	What's there
Architecture	How the libraries, providers, frontend, and WOPI client fit together at runtime.
Configuration	Wopi:* and AppHost:* knobs (Azure storage, OIDC sample, etc.).
Hosting	IIS, HTTPS, Docker, running individual projects, older runtimes.
Collabora Online	End-to-end editing with CODE — AppHost wiring, NetZone / proof-key gotchas.
Extending WopiHost	Custom storage and lock providers, permissions, the minimal-host snippet.
CheckFileInfo customization	Overriding the response payload via IWopiHostExtensions hooks.
Bootstrap endpoint	Wiring /wopibootstrapper for Office mobile.
Cobalt	What MS-FSSHTTP buys you and why the build complains.
Useful resources · Interesting WOPI projects	Specs, external write-ups, other implementations worth a look.

Cobalt build note

If your first build fails with Microsoft.CobaltCore.*.nupkg not found, that is expected. Cobalt support depends on Microsoft.CobaltCore.dll, which ships with Office Online Server / OWA / SharePoint and cannot be redistributed. You have two options:

• Build the package yourself from a SharePoint / OOS / OWA installation you are licensed for — see Craft your own Microsoft.CobaltCore NuGet package.
• Skip Cobalt — unload WopiHost.Cobalt (and its tests) from the solution. Office Online Server 2016+ does not require Cobalt; the protocol still works, just less efficiently for co-authoring on legacy clients.

See the Cobalt wiki page for context on what Cobalt buys you and when to bother.

Compatible WOPI clients

Client	Status	Notes
Office Online Server 2016+	Production	Microsoft only supports the latest version; WopiHost tracks the same. Deployment guide.
Microsoft 365 for the Web	Production	Requires CSPP onboarding plus implementing the M365-specific feature surface. The provided sample passes the WOPI-Validator.
Collabora Online (CODE)	Development / CI only	Free and redistributable, runs as a Docker container. Useful for end-to-end testing without a Microsoft license; not a substitute for OOS or M365. See the wiki for the AppHost wiring.

License

• LICENSE.txt — license for this project.
• ORIGINAL_WORK_LICENSE.txt — license for Marx Yu's original code that WopiHost.Cobalt is based on.
• NOTICE.txt — additional notes.