ONLYOFFICE Docs 10.0 turns JWT on by default and requires explicit WOPI hosts
A major release whose operator-facing parts are the defaults it changes: JWT on, WOPI hosts named explicitly, reworked converter tokens, new kill switches for the public APIs, and a 43-item security section that includes WOPI session hijacking.