Cannot log in via web interface

Support intro

Sorry to hear you’re facing problems. :slightly_frowning_face:

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart:

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 31.0.1.2
  • Operating system and version (e.g., Ubuntu 24.04):
    • OpenMediaVault 7.7.1-3
  • Web server and version (e.g, Apache 2.4.25):
    • Apache 2.4.62
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • Use reverse proxy provided by my Keenetic router, according to logs it seems to be nginx, but cannot detect its’ version
  • PHP version (e.g, 8.3):
    • 8.3.19
  • Is this the first time you’ve seen this error? (Yes / No):
    • Yes
  • When did this problem seem to first start?
    • After updating from 30 to 31
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Docker
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

When I click “log in” in web interface (when connected with DNS name), it throws me back to login screen without any messages. Logging in from local network with server local IP works as intended. Also I can log in via other apps, such as Celeste sync client or Thunderbird (not sure about other apps I use, I’m affraid to log out as now they function well).

I tested two fresh containers - one with NC30 and another with NC31. Problem appears only on second container.

Steps to replicate it (hint: details matter!):

Log entries

Nextcloud

Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.

Every time I try to log in, I see this message in logs:

Debug    bruteForce         RuntimeException: The loading of lazy AppConfig values have been triggered by app "bruteForce" at lib/private/AppConfig.php line 2025-03-19T08:18:46+00:00 
                              1208                                                                                                                                                       
                                                                                                                                                                                         
                               0. lib/private/AppConfig.php line 1193                                                                                                                    
                                  OC\AppConfig->loadConfig("bruteForce", null)                                                                                                           
                               1. lib/private/AppConfig.php line 106                                                                                                                     
                                  OC\AppConfig->loadConfigAll("bruteForce")                                                                                                              
                               2. lib/private/Security/Ip/BruteforceAllowList.php line 39                                                                                                
                                  OC\AppConfig->getKeys("bruteForce")                                                                                                                    
                               3. lib/private/Security/Bruteforce/Throttler.php line 86                                                                                                  
                                  OC\Security\Ip\BruteforceAllowList->isBypassListed("37.230.157.5")                                                                                     
                               4. lib/private/Security/Bruteforce/Throttler.php line 112                                                                                                 
                                  OC\Security\Bruteforce\Throttler->isBypassListed("37.230.157.5")                                                                                       
                               5. lib/private/Security/Bruteforce/Throttler.php line 129                                                                                                 
                                  OC\Security\Bruteforce\Throttler->getAttempts("37.230.157.5", "login")                                                                                 
                               6. lib/private/Security/Bruteforce/Throttler.php line 202                                                                                                 
                                  OC\Security\Bruteforce\Throttler->getDelay("37.230.157.5", "login")                                                                                    
                               7. .../Middleware/Security/BruteForceMiddleware.php line 64                                                                                               
                                  OC\Security\Bruteforce\Throttler->sleepDelayOrThrowOnMax("37.230.157.5", "login")                                                                      
                               8. .../Middleware/MiddlewareDispatcher.php line 73                                                                                                        
                                  OC\AppFramework\Middleware\Security\BruteForceMiddleware->beforeController(                                                                            
                                    OC\Core\Controller\LoginController {},                                                                                                               
                                    "tryLogin"                                                                                                                                           
                                  )                                                                                                                                                      
                               9. .../private/AppFramework/Http/Dispatcher.php line 106                                                                                                  
                                  OC\AppFramework\Middleware\MiddlewareDispatcher->beforeController(OC\Core\Controller\LoginController {}, "tryLogin")                                   
                              10. lib/private/AppFramework/App.php line 161                                                                                                              
                                  OC\AppFramework\Http\Dispatcher->dispatch(OC\Core\Controller\LoginController {}, "tryLogin")                                                           
                              11. lib/private/Route/Router.php line 307                                                                                                                  
                                  OC\AppFramework\App::main(                                                                                                                             
                                    "OC\\Core\\Controller\\LoginController",                                                                                                             
                                    "tryLogin",                                                                                                                                          
                                    OC\AppFramework\DependencyInjection\DIContainer {},                                                                                                  
                                    {_route:"core.login.trylogin"}                                                                                                                       
                                  )                                                                                                                                                      
                              12. lib/base.php line 1022                                                                                                                                 
                                  OC\Route\Router->match("\/login")                                                                                                                      
                              13. index.php line 24                                                                                                                                      
                                  OC::handleRequest(                                                                                                                                     
                                                                                                                                                                                         
                                  )

This happens even if I turn off bruteforce protection by setting auth.bruteforce.protection.enabled false in config.php

Web Browser

If the problem is related to the Web interface, open your browser inspector Console and Network tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear.

Nothing relevant
Console gives some warnings. There’s common one both for my main instance, which is affected with issue, and for fresh test container with Nextcloud 30, which works for me. I marked warnings, specific to problematic instance with [!]:

[!]Content-Security-Policy warnings 3**
  [!]Content-Security-Policy: Ignoring “'self'” within script-src-elem: ‘strict-dynamic’ specified login
  [!]Content-Security-Policy: Ignoring “https://192.168.1.101” within script-src-elem: ‘strict-dynamic’ specified login
  [!]Content-Security-Policy: Ignoring ‘unsafe-eval’ or ‘wasm-unsafe-eval’ inside “script-src-elem”. login
Expected declaration but found ‘;’.  Skipped to next declaration. login:10:21
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:55:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:71:13
Expected ‘none’, URL, or filter function but found ‘alpha(’.  Error in parsing value for ‘filter’.  Declaration dropped. login:137:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:204:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:309:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:321:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:585:13
Expected ‘none’, URL, or filter function but found ‘alpha(’.  Error in parsing value for ‘filter’.  Declaration dropped. login:15:10
Unknown property ‘-moz-transition’.  Declaration dropped. login:18:18
[!]Unknown pseudo-class or pseudo-element ‘-ms-clear’.  Ruleset ignored due to bad selector. login:176:11**
[!]Unknown pseudo-class or pseudo-element ‘-ms-clear’.  Ruleset ignored due to bad selector. login:1:6303
[!]Unknown pseudo-class or pseudo-element ‘-ms-input-placeholder’.  Ruleset ignored due to bad selector. login:1:6900
[!]Unknown property ‘line-clamp’.  Declaration dropped. login:98:14
session heartbeat polling started core-main.js:1:28724

What’s about network tab, it shows that all components (mainly stylesheet and couple of JS scripts) are loaded successfully with code 200. I saved all to HAR, which gives more complex information, but it’s impossible to attach file here or paste text from it.

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

Nothing relevant

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "xxxx.yyyy.keenetic.link",
            "192.168.1.101:8080"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "default_language": "ru",
        "default_locale": "ru_RU",
        "default_phone_region": "RU",
        "version": "31.0.1.2",
        "overwritehost": "xxxx.yyyy.keenetic.link",
        "overwrite.cli.url": "https:\/\/xxxx.yyyy.keenetic.link",
        "overwriteprotocol": "https",
        "trusted_proxies": "192.168.1.1",
        "forwarded_for_headers": [
            "X-Forwarded-For"
        ],
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "memories.exiftool": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/go-vod-amd64",
        "maintenance": false,
        "maintenance_window_start": 1,
        "session_lifetime": 259200,
        "enabledPreviewProviders": [
            "OC\\Preview\\Image",
            "OC\\Preview\\Movie"
        ],
        "filesystem_check_changes": 1,
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [
            "news",
            "forms",
            "maps",
            "side_menu",
            "epubviewer",
            "gpxedit",
            "user_pwauth"
        ],
        "loglevel": 0,
        "memories.gis_type": 1,
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe"
    }
}

Apps

Enabled:
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - calendar: 5.2.0
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.0.4
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - epubviewer: 1.7.3
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_3dmodelviewer: 0.0.15
  - files_downloadlimit: 4.0.0
  - files_external: 1.23.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - forms: 5.0.3
  - integration_mastodon: 3.1.1
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - mail: 4.3.1
  - maps: 1.5.0
  - memories: 7.5.2
  - music: 2.1.2
  - news: 25.3.0
  - nextcloud_announcements: 3.0.0
  - notes: 4.11.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - passwords: 2025.2.20
  - previewgenerator: 5.8.0
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - tables: 0.9.0
  - tasks: 0.16.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - whiteboard: 1.0.5
  - workflowengine: 2.13.0
Disabled:
  - activity: 4.0.0 (installed 3.0.0)
  - admin_audit: 1.21.0
  - analytics: 5.2.4 (installed 5.2.4)
  - collectives: 2.16.1 (installed 2.16.1)
  - encryption: 2.19.0
  - photos: 4.0.0-dev.1 (installed 3.0.2)
  - recognize: 9.0.0 (installed 8.2.0)
  - richdocuments: 8.6.2 (installed 8.6.2)
  - richdocumentscode: 24.4.1302 (installed 24.4.1302)
  - side_menu: 4.1.1 (installed 4.1.1)
  - spreed: 21.0.1 (installed 21.0.1)
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - user_ldap: 1.22.0 (installed 1.22.0)

Tips for increasing the likelihood of a response

  • Use the preformatted text formatting option in the editor for all log entries and configuration output.
  • If screenshots are useful, feel free to include them.
    • If possible, also include key error output in text form so it can be searched for.
  • Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you.

Look the app Brute-force settings. Maybe you can change the settings or disable the app. Please disable the app in your app list.

Do you really get the same logs if setting to “false”? Please disable it, clear all logs and post logs again.

Here’s the new log:

  Debug    bruteForce         RuntimeException: The loading of lazy AppConfig values have been triggered by app "bruteForce" at lib/private/AppConfig.php line 2025-03-19T09:15:24+00:00 
                              1208                                                                                                                                                       
                                                                                                                                                                                         
                               0. lib/private/AppConfig.php line 1193                                                                                                                    
                                  OC\AppConfig->loadConfig("bruteForce", null)                                                                                                           
                               1. lib/private/AppConfig.php line 106                                                                                                                     
                                  OC\AppConfig->loadConfigAll("bruteForce")                                                                                                              
                               2. lib/private/Security/Ip/BruteforceAllowList.php line 39                                                                                                
                                  OC\AppConfig->getKeys("bruteForce")                                                                                                                    
                               3. lib/private/Security/Bruteforce/Throttler.php line 86                                                                                                  
                                  OC\Security\Ip\BruteforceAllowList->isBypassListed("37.230.157.5")                                                                                     
                               4. lib/private/Security/Bruteforce/Throttler.php line 112                                                                                                 
                                  OC\Security\Bruteforce\Throttler->isBypassListed("37.230.157.5")                                                                                       
                               5. lib/private/Security/Bruteforce/Throttler.php line 129                                                                                                 
                                  OC\Security\Bruteforce\Throttler->getAttempts("37.230.157.5", "login")                                                                                 
                               6. lib/private/Security/Bruteforce/Throttler.php line 202                                                                                                 
                                  OC\Security\Bruteforce\Throttler->getDelay("37.230.157.5", "login")                                                                                    
                               7. .../Middleware/Security/BruteForceMiddleware.php line 64                                                                                               
                                  OC\Security\Bruteforce\Throttler->sleepDelayOrThrowOnMax("37.230.157.5", "login")                                                                      
                               8. .../Middleware/MiddlewareDispatcher.php line 73                                                                                                        
                                  OC\AppFramework\Middleware\Security\BruteForceMiddleware->beforeController(                                                                            
                                    OC\Core\Controller\LoginController {},                                                                                                               
                                    "tryLogin"                                                                                                                                           
                                  )                                                                                                                                                      
                               9. .../private/AppFramework/Http/Dispatcher.php line 106                                                                                                  
                                  OC\AppFramework\Middleware\MiddlewareDispatcher->beforeController(OC\Core\Controller\LoginController {}, "tryLogin")                                   
                              10. lib/private/AppFramework/App.php line 161                                                                                                              
                                  OC\AppFramework\Http\Dispatcher->dispatch(OC\Core\Controller\LoginController {}, "tryLogin")                                                           
                              11. lib/private/Route/Router.php line 307                                                                                                                  
                                  OC\AppFramework\App::main(                                                                                                                             
                                    "OC\\Core\\Controller\\LoginController",                                                                                                             
                                    "tryLogin",                                                                                                                                          
                                    OC\AppFramework\DependencyInjection\DIContainer {},                                                                                                  
                                    {_route:"core.login.trylogin"}                                                                                                                       
                                  )                                                                                                                                                      
                              12. lib/base.php line 1022                                                                                                                                 
                                  OC\Route\Router->match("\/login")                                                                                                                      
                              13. index.php line 24                                                                                                                                      
                                  OC::handleRequest(                                                                                                                                     
                                                                                                                                                                                         
                                  )  

and here’s new config file:

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "xxxx.yyyy.keenetic.link",
            "192.168.1.101:8080"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "default_language": "ru",
        "default_locale": "ru_RU",
        "default_phone_region": "RU",
        "version": "31.0.1.2",
        "overwritehost": "xxxx.yyyy.keenetic.link",
        "overwrite.cli.url": "https:\/\/xxxx.yyyy.keenetic.link",
        "overwriteprotocol": "https",
        "trusted_proxies": "192.168.1.1",
        "forwarded_for_headers": [
            "X-Forwarded-For"
        ],
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "memories.exiftool": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/go-vod-amd64",
        "maintenance": false,
        "maintenance_window_start": 1,
        "session_lifetime": 259200,
        "enabledPreviewProviders": [
            "OC\\Preview\\Image",
            "OC\\Preview\\Movie"
        ],
        "filesystem_check_changes": 1,
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [
            "news",
            "forms",
            "maps",
            "side_menu",
            "epubviewer",
            "gpxedit",
            "user_pwauth"
        ],
        "loglevel": 0,
        "memories.gis_type": 1,
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "auth.bruteforce.protection.enabled": false
    }
}

There is a log entry. Please go to https://cloud.server.tld/settings/apps/installed and deactivate the app bruteForce. In my opinion, the entry should not even exist.

There’s no such app in list, only Brute-force settings I also disabled before.

so occ app:list bruteforcesettings display in disabled?

1 Like

ok crazy, did you try to deinstall the bruteforce app?

root@raft-server:~# docker exec -it -u 33 nextcloud-app-1 php occ app:disable bruteforce
No such app enabled: bruteforce
root@raft-server:~# docker exec -it -u 33 nextcloud-app-1 php occ app:remove bruteforce
bruteforce is not enabled
root@raft-server:~# docker exec -it -u 33 nextcloud-app-1 php occ app:enable bruteforce
Could not download app bruteforce
root@raft-server:~# docker exec -it -u 33 nextcloud-app-1 php occ app:remove bruteforcesettings
bruteforcesettings could not be removed as it is a shipped app

Search brute in the search-field at the top at https://cloud.server.tld/index.php/settings/apps/installed.

Still the same. I also added my current external IP to whitelist, but nothing changed.

Unfortunately, I don’t understand how this message can appear if you have completely deactivated the app.

Should I submit it to GitHub as bug? I didn’t do this earlier because bug submission page asks to not create issues related to reverse proxy (and I think my problem could be). But as you noticed, it’s strange that I still get bruteforce messages even if protection is disabled.

The web console part is likely relevant given the symptoms described. Please check both tabs while triggering the login attempt.

The web server HTTP transactions (obtained from the Nextcloud app container logs) from the successful versus unsuccessful attempts would also be helpful to compare.

I would also suggest setting your loglevel back to 2 or at least 1, since 0 will be way to verbose and likely make it hard to determine what may be relevant server-side (if anything).

Also, can you attempt in a different browser?

There is no such thing as a Brute Force app. BFP integrated into server itself. The only related app is the Brute Force Settings app which is only used to manage whitelisting (mostly).

In any case, the log posted by OP isn’t an error. It’s only visible since they have loglevel set to 0 (debug). However, there are no indications OP’s problem is a brute force related matter (based on what I see in this thread so far).

Ok. Then I would take a new approach with the meaningless logs.

Uninstall all subsequently installed apps. Start with the apps that you don’t need anyway. Don’t just deactivate them, uninstall them. Third-party apps often lead to untraceable problems of all kinds.

Thank you for advice. I re-chekked my browser’s (firefox) inspector and found some warnings in console. I also checked console output when logging in working fresh NC30 installation. Here’s console warnings, I marked entries specific to problematic instance with [!]

[!]Content-Security-Policy warnings 3**
  [!]Content-Security-Policy: Ignoring “'self'” within script-src-elem: ‘strict-dynamic’ specified login
  [!]Content-Security-Policy: Ignoring “https://192.168.1.101” within script-src-elem: ‘strict-dynamic’ specified login
  [!]Content-Security-Policy: Ignoring ‘unsafe-eval’ or ‘wasm-unsafe-eval’ inside “script-src-elem”. login
Expected declaration but found ‘;’.  Skipped to next declaration. login:10:21
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:55:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:71:13
Expected ‘none’, URL, or filter function but found ‘alpha(’.  Error in parsing value for ‘filter’.  Declaration dropped. login:137:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:204:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:309:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:321:13
Expected ‘none’, URL, or filter function but found ‘progid’.  Error in parsing value for ‘filter’.  Declaration dropped. login:585:13
Expected ‘none’, URL, or filter function but found ‘alpha(’.  Error in parsing value for ‘filter’.  Declaration dropped. login:15:10
Unknown property ‘-moz-transition’.  Declaration dropped. login:18:18
[!]Unknown pseudo-class or pseudo-element ‘-ms-clear’.  Ruleset ignored due to bad selector. login:176:11**
[!]Unknown pseudo-class or pseudo-element ‘-ms-clear’.  Ruleset ignored due to bad selector. login:1:6303
[!]Unknown pseudo-class or pseudo-element ‘-ms-input-placeholder’.  Ruleset ignored due to bad selector. login:1:6900
[!]Unknown property ‘line-clamp’.  Declaration dropped. login:98:14
session heartbeat polling started core-main.js:1:28724

Quick look at network tab shows successful load of different stylesheet and a couple of scripts. I saved all entries into HAR file, but text it contains is too big for posting and I cannot attach this filetype. If it could be helpful, I can attach screenshot of network or try to upload file somewhere.

I also tried logging in from edge, it also doesn’t work, also gives warnings, but here it’s more complicated to highlight ones specific to problematic instance.

About container logs. Failed logins give these lines:

37.230.157.5 - - [20/Mar/2025:09:30:13 +0300] "POST /login HTTP/1.1" 303 1651 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:30:14 +0300] "GET /login?direct=1&user=fchib HTTP/1.1" 200 9516 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:30:15 +0300] "GET /index.php/apps/files/preview-service-worker.js HTTP/1.1" 200 6411 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:30:15 +0300] "GET /dist/core-main.js.map?v=22f5cc4a421272b05753 HTTP/1.1" 200 801520 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:30:16 +0300] "GET /index.php/apps/files/preview-service-worker.js HTTP/1.1" 200 6411 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"

when succesful (made through port forwarding) give these:

37.230.157.5 - - [20/Mar/2025:09:37:42 +0300] "POST /login HTTP/1.1" 303 1289 "http://raft-network.keenetic.link:8080/login?clear=1" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:43 +0300] "GET /apps/dashboard/ HTTP/1.1" 200 13391 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:44 +0300] "GET /custom_apps/tasks/css/tasks-store.css?v=f5f692bb-2 HTTP/1.1" 404 8206 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:44 +0300] "GET /custom_apps/tasks/css/tasks-Plus.css?v=f5f692bb-2 HTTP/1.1" 404 8207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:44 +0300] "GET /custom_apps/tasks/css/tasks-TaskCreateDialog.css?v=f5f692bb-2 HTTP/1.1" 404 8207 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:45 +0300] "GET /ocs/v2.php/apps/dashboard/api/v1/widgets HTTP/1.1" 200 1812 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:45 +0300] "GET /ocs/v2.php/apps/recommendations/api/v1/recommendations/always HTTP/1.1" 200 1155 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:45 +0300] "GET /apps/notifications/js/NotificationsApp-Cq0-VetL.chunk.mjs HTTP/1.1" 200 108609 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:45 +0300] "GET /apps/recommendations/js/recommendations-dashboard.js.map?v=66ad2e18d1c4c8731664 HTTP/1.1" 200 767617 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:45 +0300] "PROPFIND /remote.php/dav/ HTTP/1.1" 207 1103 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:45 +0300] "PUT /ocs/v2.php/apps/user_status/api/v1/heartbeat?format=json HTTP/1.1" 200 920 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:46 +0300] "GET /ocs/v2.php/apps/weather_status/api/v1/location HTTP/1.1" 200 924 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:46 +0300] "GET /ocs/v2.php/apps/user_status/api/v1/user_status HTTP/1.1" 200 920 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:46 +0300] "PUT /ocs/v2.php/apps/user_status/api/v1/heartbeat?format=json HTTP/1.1" 200 919 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:46 +0300] "GET /dist/core-main.js.map?v=22f5cc4a421272b05753 HTTP/1.1" 200 801576 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:46 +0300] "GET /ocs/v2.php/apps/dashboard/api/v2/widget-items?widgets%5B%5D=calendar HTTP/1.1" 200 1574 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:46 +0300] "GET /apps/notes/notes/dashboard HTTP/1.1" 200 1765 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:46 +0300] "GET /ocs/v2.php/apps/dashboard/api/v2/widget-items?widgets%5B%5D=mail-unread HTTP/1.1" 200 1511 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "GET /ocs/v2.php/apps/weather_status/api/v1/forecast HTTP/1.1" 200 1337 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "PROPFIND /remote.php/dav/principals/users/fchib/ HTTP/1.1" 207 1785 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "GET /ocs/v2.php/apps/weather_status/api/v1/favorites HTTP/1.1" 200 850 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - fchib [20/Mar/2025:09:37:47 +0300] "PROPFIND /remote.php/dav/calendars/fchib/1/ HTTP/1.1" 400 20611 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:47 +0300] "PROPFIND /remote.php/dav/calendars/fchib/1-1/ HTTP/1.1" 400 20615 "-" "Evolution/3.54.3"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/1.1" 200 1270 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/1.1" 200 1270 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - fchib [20/Mar/2025:09:37:47 +0300] "PROPFIND /remote.php/dav/calendars/fchib/contact_birthdays/ HTTP/1.1" 400 20615 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:47 +0300] "REPORT /remote.php/dav/calendars/fchib/1/ HTTP/1.1" 400 20613 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:47 +0300] "REPORT /remote.php/dav/calendars/fchib/1-1/ HTTP/1.1" 400 20613 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:47 +0300] "REPORT /remote.php/dav/calendars/fchib/contact_birthdays/ HTTP/1.1" 400 20613 "-" "Evolution/3.54.3"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "GET /avatar/guest/Cron%20Daemon/44 HTTP/1.1" 201 2151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "GET /avatar/guest/%D0%A2-%D0%91%D0%B0%D0%BD%D0%BA/44 HTTP/1.1" 201 1201 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "PROPFIND /remote.php/dav/calendars/fchib/ HTTP/1.1" 207 3076 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:48 +0300] "REPORT /remote.php/dav/calendars/fchib/personal/ HTTP/1.1" 207 28730 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:48 +0300] "REPORT /remote.php/dav/calendars/fchib/98b56133-e1da-472c-8169-8ccf32191eaf/ HTTP/1.1" 207 15400 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:48 +0300] "REPORT /remote.php/dav/calendars/fchib/sciencely/ HTTP/1.1" 207 8561 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:48 +0300] "REPORT /remote.php/dav/calendars/fchib/-/ HTTP/1.1" 207 9654 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - fchib [20/Mar/2025:09:37:48 +0300] "GET /index.php/204 HTTP/1.1" 400 20053 "-" "Mozilla/5.0 (Linux) mirall/3.15.3daily (Nextcloud, fedora-6.13.6-200.fc41.x86_64 ClientArchitecture: x86_64 OsArchitecture: x86_64)"
37.230.157.5 - - [20/Mar/2025:09:37:47 +0300] "GET /apps/integration_mastodon/notifications HTTP/1.1" 200 33061 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - - [20/Mar/2025:09:37:48 +0300] "GET /custom_apps/integration_mastodon/js/integration_mastodon-dashboard-lazy.js.map?v=b13eb30e2d790427de3d HTTP/1.1" 200 10403 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0"
37.230.157.5 - fchib [20/Mar/2025:09:37:52 +0300] "PROPFIND /remote.php/dav/calendars/fchib/personal/ HTTP/1.1" 400 20603 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:52 +0300] "REPORT /remote.php/dav/calendars/fchib/personal/ HTTP/1.1" 400 20603 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:52 +0300] "PROPFIND /remote.php/dav/calendars/fchib/1-2/ HTTP/1.1" 400 20609 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:52 +0300] "REPORT /remote.php/dav/calendars/fchib/1-2/ HTTP/1.1" 400 20611 "-" "Evolution/3.54.3"
37.230.157.5 - fchib [20/Mar/2025:09:37:53 +0300] "GET /index.php/apps/news/api/v1-3/folders HTTP/1.1" 400 20609 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:122.0)"
37.230.157.5 - fchib [20/Mar/2025:09:37:53 +0300] "GET /index.php/apps/news/api/v1-3/items/updated HTTP/1.1" 400 20603 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:122.0)"
37.230.157.5 - fchib [20/Mar/2025:09:37:53 +0300] "GET /index.php/apps/news/api/v1-3/feeds HTTP/1.1" 400 20604 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:122.0)"
127.0.0.1 - - [20/Mar/2025:09:37:53 +0300] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.62 (Debian) PHP/8.3.19 (internal dummy connection)"
127.0.0.1 - - [20/Mar/2025:09:37:54 +0300] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.62 (Debian) PHP/8.3.19 (internal dummy connection)"
127.0.0.1 - - [20/Mar/2025:09:37:55 +0300] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.62 (Debian) PHP/8.3.19 (internal dummy connection)"

First try to disable bruteforce protection through the config.php:

You would need to adjust the parameter auth.bruteforce.protection.enabled in your Nextcloud config.php to disable brute force protection, which is heavily discouraged for production servers, particularly if your server is reachable via a public IP address. It allows an attacker to iterate over all users and their passwords as well as two-factor verifications afterwards ultimately leading to admin access.

auth.bruteforce.protection.enabled=false

If login works, it is bruteforce settings. If still not working, it is not bruteforce protection.

This page from the docs is providing a lot of valuable hints and tweaks in regard to bruteforce protection

So I was playing around with my reverse proxy configuration and found out that preservation of Origin header solves problem. If you’re also running your instance through KeenDNS - use your router’s cli command ip http proxy {4 level domain you use to access your instance} preserve-origin. Thanks for everybody envolved!

1 Like

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.