I can't log in to Nextcloud: token expired and logged out

Support intro

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 34.0.3
  • Operating system and version (e.g., Ubuntu 24.04):
    • Hébergement Nuxit, PHP 8.4
  • PHP version (e.g, 8.3):
    • 8.4
  • Is this the first time you’ve seen this error? (Yes / No):
    • yes
  • When did this problem seem to first start?
    • after installation
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Web updater
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • no

Summary of the issue you are facing:

The installation using Web Updater went smoothly. I was able to change various settings in the web interface. I created another account and logged out to test it.

On my first login, I received the following message: Session Error. It appears that your session token has expired; please refresh the page and try again.

I unchecked “Remember Me,” the dashboard appeared for a few seconds, and then I was logged out without any message.

The same thing happened when I tried to log back in with the admin account.

Thank you for your help.

Log entries

Nextcloud

Nothing about bad connection

Web Browser

FIREFOX 152.0.4 (64 bits)

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

N/A

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

<?php

/*
 * WARNING
 *
 * This file gets modified by automatic processes and all lines that are not
 * active code (ie. comments) are lost during that process.
 *
 * If you want to document things with comments or use constants add your settings
 * in a '<NAME>.config.php' file which will be included and rendered into this file.
 *
 * Example:
 *   <?php
 *   $CONFIG = [];
 *
 * See also: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#multiple-merged-configuration-files
 */
$CONFIG = array (
  'instanceid' => 'ocrl0zssjhhd',
  'passwordsalt' => 'xxxxxx',
  'secret' => 'xxxxx',
  'trusted_domains' => 
  array (
    0 => 'www.xxxx.fr',
  ),
  'datadirectory' => '/home/users3/p/xxxx/www/nextcloud/data',
  'dbtype' => 'mysql',
  'version' => '34.0.3.2',
  'overwrite.cli.url' => 'https://xxxxxx/nextcloud',
  'dbname' => 'xxxx',
  'dbhost' => 'xxxx',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'xxx',
  'dbpassword' => 'xxx',
  'installed' => true,
  'config_preset' => 2,
  'mail_domain' => 'xxxx.net',
  'mail_from_address' => 'xxxx',
  'mail_smtpmode' => 'smtp',
  'mail_smtphost' => 'smtp.laposte.net',
  'mail_smtpport' => '465',
  'mail_sendmailmode' => 'smtp',
  'mail_smtpstreamoptions' => 
  array (
    'ssl' => 
    array (
      'allow_self_signed' => false,
      'verify_peer' => true,
      'verify_peer_name' => true,
    ),
  ),
  'mail_smtpsecure' => 'ssl',
  'mail_smtppassword' => 'xxxx',
  'mail_smtpname' => 'xxxx',
  'mail_smtpauth' => true,
);

Please check your web browser inspector as described in the Web Browser section of the support template.

I’ve upgrated Firefox (now version 155) this morning and i was able to connect !
After 20 mn, I’ve been logged out.
I join a screen shot of the console when I try to login :

I tried with an another web navigator (Chrome), there is the same pb.

That error looks like it’s coming from a browser extension.

Maybe try in private browsing mode and/or with extensions off?

Also watch the network tab, as noted in the support template too

The exact same thing happens with the desktop client. According to the log, the tokens are suddenly invalid or too short, and both the client and the web browser are logged out.

My user account will also be deactivated.

Hi ! Thanks for your help :slightly_smiling_face:

It’s the same pb in private browsing or with an another navigator (Chrome), even with Firefox on Android.

You will find here 3 har files from Network tabs https://drop.chapril.org/download/5e65eff5d9b1937c/#mh2lf15GcH72dngTw2C39w

  1. Login with token error

  2. Login with “Rember me” insuccessfull

  3. Login without “Rember me” successfull, dashboard appears and log out suddenly

I don’t see where is the problem

Maybe an HTTP caching layer matter?

Are you sure there isn’t a caching layer in front provided by your web hosting company maybe?

An update to Nextcloud Hub 26 Spring (34.0.4) was released today.

Since then, both the desktop client and the browser have remained logged in.
It seems like the issue has been fixed.

I uninstalled all and installed latest version.

I had 429 Too many requests Error

I modified config.php to set ‘auth.bruteforce.protection.testing’ => false

I can login now, I will set ‘auth.bruteforce.protection.testing’ => true and increase auth.bruteforce.max-attempts later.

I am setting up application’s parameters and i will notice after testing ‘auth.bruteforce.protection.testing’ => true