Cloudflare DNS Proxy breaks mobile app login flow specifically

ℹ️ Support
, , ,
1
  • Nextcloud Server version (e.g., 29.x.x):
    • 31.0.6
  • Operating system and version (e.g., Ubuntu 24.04):
    • Ubuntu 24.04
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • nginx 1.24.0
  • PHP version (e.g, 8.3):
    • php:8.3-fpm (from nextcloud:31.0.6-fpm)
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Docker
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • Cloudflare (DNS)

I had Nextcloud set up at a subdomain we’ll call cloud.example.com with Cloudflare DNS proxy enabled. No problems whatsoever on desktop/mobile browsers. But I tried logging in with the Nextcloud app, which opens the mobile browser to /login/v2/flow, which was unclickable as described in this thread.

After doing USB debugging, I found that authpicker.js was being served as application/octet-stream by Cloudflare, resulting in the console error: Refused to execute script from <authpicker.js> because its MIME type ('application/octet-stream') is not executable, and strict MIME type checking is enabled.

Yet I could curl this file and Cloudflare would serve it properly as application/javascript. I disabled the Cloudflare DNS proxy for the subdomain and the login page worked. Anyone else experience this and possibly know what the cause is? I’d like to put it back on proxy if possible.

2

Cloudflare is known for blocking everything that is not recognized as a well-known browser by placing a captcha in front of it or require prof of work tasks. Only some examples:

Browser Integrity Check (first link) is enabled by default.

This topic comes up again and again in this forum, you may find something via forum search. In short: The problem is not the Nextcloud app, but Cloudflare. You need to disable all Cloudflare features that cause this. You can do this with a rule in the Clouflare backend, for example. There you can configure that Cloudflare should not block bots etc.

In general, Cloudflare is not a plug-and-play solution for non webbrowser-apps.

2 Likes