App Passwords reports "api token expired" after upgrade to 30.0.6

pmc · February 24, 2025, 10:13am

After upgrading to Version 30.0.6 I got the following pop up in the UI of passwords app:

I do use an unmanged IONOS webspace.
I can see the following logs

[core] Fehlersuche: could not get login credentials because the token is invalid: Token does not exist: token does not exist
	GET /index.php/apps/passwords/api/1.0/session/request
	von 89.247.1.28 von -- um 24.02.2025, 10:46:17

[webdav] Fehlersuche: No public access to this resource., AppAPIAuth has not passed, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured
	GET /remote.php/dav/
	von 82.165.84.7 von -- um 24.02.2025, 10:56:09

Any hints what is wrong ??

Support intro

Sorry to hear you’re facing problems.

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

Official documentation (searchable and regularly updated)
How to topics and FAQs
Forum search

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can.

The Basics

Nextcloud Server version (e.g., 29.x.x):
- 30.0.6
Operating system and version (e.g., Ubuntu 24.04):
- Linux 4.4.400-icpu-101 x86_64
Web server and version (e.g, Apache 2.4.25):
- IONOS unmanaged
Reverse proxy and version _(e.g. nginx 1.27.2)
- ???
PHP version (e.g, 8.3):
- 8.3
Is this the first time you’ve seen this error? (Yes / No):
- yes
When did this problem seem to first start?
- after update to 30.0.6
Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
- update webui
Are you using CloudfIare, mod_security, or similar? (Yes / No)
- not that i am aware off ;)

Log entries

Nextcloud

The process control (PCNTL) extensions are required in case you want to interrupt long running commands - see https://www.php.net/manual/en/book.pcntl.php
Additionally the function 'pcntl_signal' and 'pcntl_signal_dispatch' need to be enabled in your php.ini.
{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.rode.family"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "30.0.6.2",
        "overwrite.cli.url": "https:\/\/cloud.rode.family",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "theme": "",
        "loglevel": 0,
        "maintenance": false,
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "updater.release.channel": "stable",
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "tls",
        "mail_sendmailmode": "smtp",
        "mail_smtpauth": 1,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "app_install_overwrite": [
            "occweb",
            "ocr",
            "drawio"
        ],
        "default_phone_region": "DE",
        "overwriteprotocol": "https",
        "enable_previews": true,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Krita",
            "OC\\Preview\\HEIC"
        ]
    }
}

Web Browser

If the problem is related to the Web interface, open your browser inspector Console and Network tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear.

PASTE

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

PASTE HERE

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

PASTE HERE

Apps

The process control (PCNTL) extensions are required in case you want to interrupt long running commands - see https://www.php.net/manual/en/book.pcntl.php
Additionally the function 'pcntl_signal' and 'pcntl_signal_dispatch' need to be enabled in your php.ini.
Enabled:
  - activity: 3.0.0
  - app_api: 4.0.6
  - calendar: 5.1.0
  - camerarawpreviews: 0.8.6
  - cloud_federation_api: 1.13.0
  - contacts: 7.0.0
  - contactsinteraction: 1.11.0
  - dav: 1.31.1
  - drawio: 3.0.3
  - federatedfilesharing: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_versions: 1.23.0
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.2.0
  - nextcloud_announcements: 2.0.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - passwords: 2024.12.21
  - photos: 3.0.2
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - spreed: 20.1.4
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_totp: 12.0.0-dev
  - updatenotification: 1.20.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - admin_audit: 1.20.0 (installed 1.7.0)
  - bruteforcesettings: 3.0.0 (installed 2.4.0)
  - circles: 30.0.0 (installed 27.0.1)
  - collectives: 2.16.1 (installed 2.16.1)
  - comments: 1.20.1 (installed 1.7.0)
  - dashboard: 7.10.0 (installed 7.2.0)
  - encryption: 2.18.0
  - epubreader: 1.4.7 (installed 1.4.7)
  - federation: 1.20.0 (installed 1.7.0)
  - files_external: 1.22.0
  - files_trashbin: 1.20.1 (installed 1.7.0)
  - firstrunwizard: 3.0.0 (installed 2.6.0)
  - maps: 1.5.0 (installed 1.5.0)
  - occweb: 0.2.2 (installed 0.2.2)
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - user_ldap: 1.21.0

jtr · February 24, 2025, 2:44pm

github.com/marius-wieschollek/passwords

[BUG]: Repeated "API Session Token expired" modal when attempting to view Passwords app

opened 08:52PM - 17 Feb 25 UTC

synthead

bug

### ⚠️ This issue respects the following points: ⚠️ - [x] This is a _single_ **…bug**, not a question or a configuration/webserver/proxy issue. - [x] This is not a bug in the [browser extension](https://github.com/marius-wieschollek/passwords-webextension) or another client. - [x] This issue is **not** already reported on Github _(I've searched it)_. - [x] Nextcloud Server and the Passwords App **is** up to date. See [Nextcloud Apps](https://apps.nextcloud.com/apps/passwords). - [x] There are no warnings and errors reported in the Passwords App settings in the admin area - [x] The following apps are not installed: Rainloop ### Server Information ```shell { "version": { "server": "30.0.6.2", "app": "2024.12.21", "lsr": false, "php": "8.2.27", "cronPhp": "8.3.15" }, "environment": { "os": "Linux", "architecture": "x86_64", "bits": 64, "database": "pgsql", "cron": "cron", "proxy": false, "sslProxy": false, "subdirectory": false }, "services": { "images": "imagick", "favicons": "default", "previews": "default", "security": "hibp", "words": "auto", "previewApi": false, "faviconApi": false }, "status": { "autoBackupRestored": false }, "settings": { "channel": "stable", "nightlies": false, "handbook": false, "performance": 5 }, "encryption": { "sse": { "SSEv1r1": false, "SSEv1r2": true, "SSEv2r1": false, "SSEv3r1": false, "none": false, "default": "SSEv1r2" }, "cse": { "CSEv1r1": false, "none": true, "default": "none" } } } ``` ### Client Information Browser and Version: Firefox 135.0 Client OS and Version: Arch Linux (rolling release, no version) ### Bug description After upgrading Nextcloud 30.0.5 to 30.0.6, I am not able to use the Passwords app. I am seeing this modal in the browser: ![Image](https://github.com/user-attachments/assets/c1876368-e9e5-43ec-a46e-9853265d928f) When the "X" is clicked, the error is revealed under the model for a second before the browser refreshes: ![Image](https://github.com/user-attachments/assets/1e601620-14cb-4496-af80-8dd0903e25dd) When the refresh occurs, the model in the first screenshot is displayed, and it continues in an interactive, infinite loop. In the network inspector, I can observe that this reqest: ``` https://myserver/index.php/apps/passwords/api/1.0/session/request ``` ...returns 401 with the body: ``` {"message":"CORS requires basic auth"} ``` In addition, in `nextcloud.log`, when loading the Passwords app, I am able to observe this entry: ```json { "reqId": "<censored>", "level": 0, "time": "2025-02-17T20:48:35+00:00", "remoteAddr": "10.1.0.1", "user": "--", "app": "core", "method": "GET", "url": "/index.php/apps/passwords/api/1.0/session/request", "message": "could not get login credentials because the token is invalid: Token does not exist: token does not exist", "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0", "version": "30.0.6.2", "data": { "app": "core" } } ``` I should mention that Nextcloud and the Passwords app has been working fine for years. This problem seems to have been triggered after the update to Nextcloud 30.0.6. ### Steps to reproduce There's probably something I'm missing, but I am reproducing this via: 1. Install nextcloud 30.0.6-1 on Arch Linux. 2. Install the Passwords app. 3. Attempt to open the Passwords app. ### Expected behavior 1. Open the Passwords app. 2. The Passwords app is displayed. ### Nextcloud Logs ```shell { "reqId": "<censored>", "level": 0, "time": "2025-02-17T20:48:35+00:00", "remoteAddr": "10.1.0.1", "user": "--", "app": "core", "method": "GET", "url": "/index.php/apps/passwords/api/1.0/session/request", "message": "could not get login credentials because the token is invalid: Token does not exist: token does not exist", "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0", "version": "30.0.6.2", "data": { "app": "core" } } ``` ### Browser Logs ```shell n/a ```

system · March 7, 2025, 7:41pm

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.