Implications of sharing the same app password between several Floccus / Nextcloud Bookmarks plugins on several Firefox Profiles/devices

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 31.0.6
  • Operating system and version (e.g., Ubuntu 24.04):
    • YunoHost 12 (Debian 12)
  • Web server and version (e.g, Apache 2.4.25):
    • Nginx 1.22.1-9+deb12u2
  • PHP version (e.g, 8.3):
    • 8.3.22
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • YunoHost on bare metal
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • no

Summary of the issue you are facing:

I have more than a dozen of Firefox Profiles / devices that I sync tabs and bookmarks from through Floccus and NC Bookmarks – one for each KDE Plasma Activity.

Since I have so many, I decided to use the export/import functionality of the Floccus add-on on Firefox. What I noticed then is that it does ask me to authenticate through my Nextcloud server when I set up a new Floccus install on a new Firefox Profile.

I noticed though, that it seems syncing now takes much longer. I have currently about 1600 tabs and about 800 bookmarks that are synced. I suspect a sync should be fairly quick, but it takes many minutes, sometimes over an hour to finish.

Which got me thinking – is it possible that what happened is that by importing the existing Floccus profiles, Nextcloud (Bookmark) treats all these profiles as being from the same device, which, I imagine, is not what the app password is intended to do. Does this mean that Nextcloud (Bookmarks) in this case handles the syncing between these dozen(s) of Floccus/Firefox profiles as if they all come from the same “device” and as such queues the syncing differently?

I wonder how to fix this slowness – should I re-authenticate each Floccus/Firefox profile with the NC server, so each profile has its own NC app password? (If so, it might make sense to remove from the Floccus profile export the part that causes this.)

Steps to replicate it (hint: details matter!):

  1. install Bookmark app on Nextcloud (NC) install Floccus on Firefox (FF)
  2. create a Floccus profile, linking it to NC and authenticate the session, essentially creating a new app password – I did one for pushing tabs into /tabs and another one for default syncing bookmarks to / (i.e. both bookmarks and tabs)
  3. export the created Floccus profile(s)
  4. install Floccus on another FF profile (either using activity-aware Firefox or otherwise)
  5. import the profile from step 3 – notice not being asked to authenticate
  6. wait for the sync to start or trigger it yourself
  7. notice how it takes several (tens) of minutes – some took several hours (and haven’t finished), but closing and re-opening Firefox and re-triggering the sync helped

Log entries

irrelevant …but can provide them if needed.

Configuration

Nextcloud

The output of occ config:list system:

{                 
    "system": {                                                                     
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",                            
        "secret": "***REMOVED SENSITIVE VALUE***",                                  
        "trusted_domains": [                                                        
            "localhost",              
            "bigwhoop.wheremymonkeyis.at"                                           
        ],                                                                          
        "datadirectory": "***REMOVED SENSITIVE VALUE***",                           
        "dbtype": "mysql",                                                                                                                                               
        "version": "31.0.6.2",                                                      
        "overwrite.cli.url": "https:\/\/bigwhoop.wheremymonkeyis.at\/",             
        "dbname": "***REMOVED SENSITIVE VALUE***",                                  
        "dbhost": "***REMOVED SENSITIVE VALUE***",     
        "dbport": "",                                                               
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",       
        "dbpassword": "***REMOVED SENSITIVE VALUE***",       
        "installed": true,         
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "updatechecker": false,    
        "memcache.local": "\\OC\\Memcache\\APCu",
        "integrity.check.disabled": true,                                           
        "filelocking.enabled": true, 
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "6379",       
            "timeout": "0.0",
            "password": "***REMOVED SENSITIVE VALUE***"
        },                            
        "hashing_default_password": true,                                           
        "localstorage.allowsymlinks": true,                
        "simpleSignUpLink.shown": false,
        "logout_url": "https:\/\/monolith.wheremymonkeyis.at\/yunohost\/sso\/?action=logout&r=aHR0cHM6Ly9iaWd3aG9vcC53aGVyZW15bW9ua2V5aXMuYXQv",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "",
        "loglevel": 2,
        "mail_smtpport": "25",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "app_install_overwrite": [
            "news"
        ],
        "maintenance_window_start": 1,
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30"
    }
}

Apps

The output of occ app:list:

Enabled:         
  - activity: 4.0.0       
  - admin_audit: 1.21.0
  - app_api: 5.0.2                 
  - bookmarks: 15.1.0
  - bruteforcesettings: 4.0.0
  - calendar: 5.3.2               
  - circles: 31.0.0       
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0    
  - contacts: 7.1.3              
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0     
  - dav: 1.33.0   
  - deck: 1.15.1            
  - federatedfilesharing: 1.21.0                                                    
  - federation: 1.21.0                                                              
  - files: 2.3.1                 
  - files_downloadlimit: 4.0.0                                                      
  - files_external: 1.23.0                                                          
  - files_fulltextsearch: 31.0.0                                                    
  - files_pdfviewer: 4.0.0      
  - files_reminders: 1.4.0                                                          
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0                                                                                                                                      
  - files_versions: 1.24.0 
  - firstrunwizard: 4.0.0
  - forms: 5.1.0 
  - fulltextsearch: 31.0.0
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - mail: 5.1.3      
  - news: 26.0.1       
  - nextcloud_announcements: 3.0.0
  - notes: 4.12.1         
  - notifications: 4.0.0    
  - oauth2: 1.19.1      
  - password_policy: 3.0.0       
  - photos: 4.0.0-dev.1   
  - privacy: 3.0.0        
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recognize: 9.0.1                                                                
  - recommendations: 4.0.0                                                          
  - related_resources: 2.0.0     
  - richdocuments: 8.7.1                                                            
  - serverinfo: 3.0.0                                                               
  - settings: 1.14.0                                                                
  - sharebymail: 1.21.0         
  - socialsharing_email: 3.3.0                                                      
  - support: 3.0.0 
  - survey_client: 3.0.0
  - suspicious_login: 9.0.1
  - systemtags: 1.21.1
  - tasks: 0.16.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - user_ldap: 1.22.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflow_ocr: 1.31.0
  - workflow_pdf_converter: 2.0.0
  - workflow_script: 2.0.0
  - workflowengine: 2.13.0
Disabled:
  - encryption: 2.19.0
  - files_antivirus: 6.0.2 (installed 6.0.2)
  - files_rightclick: 1.6.0 (installed 1.6.0)
  - maps: 1.5.0 (installed 1.5.0)
  - qownnotesapi: 25.2.0 (installed 25.2.0)
  - snowflakestheme: 1.1.3 (installed 1.1.3)
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - updatenotification: 1.21.0 (installed 1.17.0)
  - uppush: 2.3.0 (installed 2.3.0)
  - workflow_kitinerary: 1.8.0 (installed 1.8.0)