How to identify users of a specific text session (/index.php/apps/text/session/XXXXXX/{push,save})

On a nextcloud instance installed from the nextcloud:production-fpm official docker image we start seeing a lot of 412 HTTP error code in the log producing a huge load on the server.

An unresolved issue similar to our problems have been found in the Github repository : [Bug]: CSRF check failed · Issue #40626 · nextcloud/server · GitHub.

Apart from the numerous /ocs/v2.php/apps/notifications/api/v2/notifications errors a lot (3 per seconds) of POST on /index.php/apps/text/session/XXXXXX/push and POST on /index.php/apps/text/session/XXXXXX/save produced also 412 Precondition Failed HTTP code.

I would like to find to what session this number links to.

Is there a way to find what users are concerned by these text session id?

In fact it seems that this number is the fileId as found in the internal link of a file (an URL of the form https://nextcloud.example.com/index.php/f/XXXXXX>).

The next question is then is there a way to list all user using a file at a given moment?

I’m under impression “nc-who” could help but usually the user is alos listed in the log - use jq to improve readability like here: I get an 404 after adding 4 lines in config.php, even after I removed them - #8 by ernolf