Permission & Access Issues

How to Restrict Header and Footer Editing in WOPI Integrations

Muhammad Talha Oct 10, 2026 871 views

Question details

The user needs to restrict users from editing specific document elements, such as headers and footers, within a WOPI-integrated environment.

How to Restrict Header and Footer Editing in a WOPI Integration

Product: WOPI Integration
Device & OS: not provided
Scenario: Developing or managing a host application integrated with WOPI to control user editing capabilities on specific document sections.
Observed behavior: WOPI standard protocols lack native element-level permissions, meaning restrictions on headers and footers cannot be enforced through default client-side WOPI settings.

Before you start

Ensure you have administrative access to your host application's backend architecture and a clear understanding of its role-based access control (RBAC) system.

Solution 1Recommended

Implement Server-Side Validation and Role-Based Controls

Since WOPI does not natively support element-level restrictions, you must enforce editing restrictions through the host application's server-side authorization system.

WOPI locks are designed strictly to protect document-level editing sessions (preventing simultaneous conflicting changes) and do not offer user-specific or element-level permissions. Relying entirely on client-side restrictions is insecure, as they can often be bypassed.

Define Role-Based Access Controls (RBAC)

Configure your host application's authorization system to assign specific editing permissions to users based on their roles, distinguishing between full editors and restricted editors.

Implement Server-Side Validation

Develop backend validation logic on your host server that intercepts document save requests. The server must verify if the user's role permits changes to headers and footers, rejecting the payload if unauthorized modifications are detected.

Manage Document-Level Locks Appropriately

Continue using WOPI locks solely for managing document-level concurrency. Do not attempt to repurpose WOPI locks for granular permission handling, as they are not user-specific.

Implement Server-Side Validation and Role-Based Controls

Security Best Practice: Always enforce document restrictions and validate content changes on the server side. Client-side scripts should only be used to improve UI experience, not as a primary security measure.

Easily Restrict Document Elements Natively with WPS Office

While custom WOPI integrations require complex server-side validation to restrict specific elements, WPS Office allows you to natively lock headers, footers, and specific document sections in seconds using built-in protection features.

1. Open Document Protection: Launch WPS Writer and open the document you wish to secure. Navigate to the 'Review' tab on the top ribbon.
2. Enable Editing Restrictions: Click on the 'Restrict Editing' button to open the restriction settings pane on the right side of the screen.
3. Configure Element Locks: Check the box for 'Limit formatting to a selection of styles' or set specific read-only exceptions to prevent modification of headers and footers.
4. Apply a Password: Click 'Start Enforcing Protection' and enter a secure password to ensure only authorized users can modify the restricted sections.

Native document element and formatting protectionFull compatibility with Microsoft Word (.docx) formatsEnterprise-ready file security and encryptionLightweight application with an intuitive interface

microsoft office alternative - wps office

Frequently Asked Questions

Can WOPI locks be used to prevent editing of specific document paragraphs?

No. WOPI locks are designed exclusively to protect document-level editing sessions and prevent version conflicts during co-authoring. They are not user-specific and cannot provide granular, element-level permissions like locking specific paragraphs or headers.

Are client-side restrictions sufficient for securing document headers in WOPI?

No. Client-side restrictions can often be bypassed by users or malicious scripts. For true security in a WOPI integration, you must validate all document changes and enforce permissions on the host application's server.

Does WPS Web Office support custom permissions in WOPI integrations?

Yes, WPS Web Office integrates seamlessly with standard WOPI protocols. It relies on your host application's access tokens and authorization systems to manage secure, role-based editing access effectively.

Document & File Issues