These mean you’re web server is returning 404s or other similar errors when requesting these assets.
You’ve still yet to post your config (occ config:list system to see the parsed/merged config).
Also please check your Nextcloud log just before and while reproducing. It appears you deleted that section from the support template in your initial report so may have been overlooked.
Here the system config, not really much to see there…
{
“system”: {
“instanceid”: “REMOVED SENSITIVE VALUE”,
“passwordsalt”: “REMOVED SENSITIVE VALUE”,
“secret”: “REMOVED SENSITIVE VALUE”,
“default_language”: “de”,
“trusted_domains”: {
REMOVED*
},
“datadirectory”: “REMOVED SENSITIVE VALUE”,
“filesystem_check_changes”: 1,
“filelocking.enabled”: true,
“memcache.locking”: “\OC\Memcache\Redis”,
“redis”: {
“host”: “REMOVED SENSITIVE VALUE”,
“port”: 6379,
“password”: “REMOVED SENSITIVE VALUE”,
“timeout”: 0
},
“logfile”: “/srv/user-local/cloud.default/log/nextcloud.log”,
“overwrite.cli.url”: “https://cloud.REMOVED”,
“dbtype”: “mysql”,
“version”: “30.0.17.2”,
“dbname”: “REMOVED SENSITIVE VALUE”,
“dbhost”: “REMOVED SENSITIVE VALUE”,
“dbtableprefix”: “oc_”,
“dbuser”: “REMOVED SENSITIVE VALUE”,
“dbpassword”: “REMOVED SENSITIVE VALUE”,
“logtimezone”: “Europe/Berlin”,
“installed”: true,
“chunkSize”: “2048MB”,
“mail_smtpmode”: “smtp”,
“mail_from_address”: “REMOVED SENSITIVE VALUE”,
“mail_domain”: “REMOVED SENSITIVE VALUE”,
“mail_smtphost”: “REMOVED SENSITIVE VALUE”,
“mail_smtpport”: “587”,
“mail_smtpstreamoptions”: {
“ssl”: {
“allow_self_signed”: true,
“verify_peer”: false,
“verify_peer_name”: false
}
},
“memcache.local”: “\OC\Memcache\APCu”,
“memcache.distributed”: “\OC\Memcache\Redis”,
“memcached_servers”: [
[
“127.0.0.1”,
11211
]
],
“loglevel”: 0,
“user_backends”: [
{
“class”: “\OCA\UserExternal\REMOVED”,
“arguments”:
}
],
"maintenance": false,
"theme": "",
"trashbin_retention_obligation": "auto, 30",
"appstore.experimental.enabled": true,
"mail_smtpauthtype": "PLAIN",
"mail_smtpauth": 1,
"mail_smtpname": "\*\*\*REMOVED SENSITIVE VALUE\*\*\*",
"mail_smtppassword": "\*\*\*REMOVED SENSITIVE VALUE\*\*\*",
"updater.release.channel": "stable",
"mysql.utf8mb4": true,
"app_install_overwrite": \[
"groupquota",
"keeweb",
"passman",
"whiteboard",
"user_external"
\],
"default_phone_region": "DE",
"mail_sendmailmode": "smtp",
"maintenance_window_start": 1,
"auth.bruteforce.protection.enabled": false,
"enable_previews": true,
"enabledPreviewProviders": \[
"OC\\\\Preview\\\\BMP",
"OC\\\\Preview\\\\GIF",
"OC\\\\Preview\\\\JPEG",
"OC\\\\Preview\\\\Krita",
"OC\\\\Preview\\\\MarkDown",
"OC\\\\Preview\\\\MP3",
"OC\\\\Preview\\\\OpenDocument",
"OC\\\\Preview\\\\PNG",
"OC\\\\Preview\\\\TXT",
"OC\\\\Preview\\\\XBitmap",
"OC\\\\Preview\\\\Imaginary"
\],
"preview_imaginary_url": "\*\*\*REMOVED SENSITIVE VALUE\*\*\*"
}
}
I knew the drag&drop would come out sh*tty…
Hm, I as a user do not request “assets”, I only login, and the NC code from the upcoming dashboard is sending quirks. For me this does not look like very controlled code, if it does not even throw out the correct mime type.
It doesn’t if you use the preformatted text option as described in the support template. 
Still looking for this Nextcloud log entries… Though you may want to bump your loglevel to 1 or 2 instead of 0 (debug) since otherwise they’ll be filled with all sorts of noise (also 0/debug level logging will slow everything down).
This would have gone a lot faster if you’d just helped us help you by filling out the initial support template to start with.
Any Ideas what this means:
{“reqId”:“EXqh84qnlOgwzgukfDg2”,“level”:3,“time”:“2026-01-13T08:30:43+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark-highcontrast.css?plain=0&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{“cookie_samesite”:“Lax”}\]”,“timeSpent”:“31.09191393852234”}}
timeSpent means the time the request took, not? So this request alone took around 31 secs?
In fact the whole mess of a login page reload looks like this:
{“reqId”:“qWXYdPUViUSFGDR0jeIL”,“level”:3,“time”:“2026-01-13T09:11:30+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark.css?plain=0&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“31.459174871444702”}}
{“reqId”:“KBAwGZ3eIwjB2nx1Jx4g”,“level”:3,“time”:“2026-01-13T09:12:01+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark-highcontrast.css?plain=0&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“62.1520779132843”}}
{“reqId”:“LR0sPWHsaungtWW1xpXd”,“level”:3,“time”:“2026-01-13T09:12:32+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/favicon?v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“30.662110805511475”}}
{“reqId”:“Qdpj0B96qq13e4Kc1zvq”,“level”:3,“time”:“2026-01-13T09:13:02+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark-highcontrast.css?plain=1&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“61.243382930755615”}}
{“reqId”:“vWdKSTsq6w9zupdNbPMQ”,“level”:3,“time”:“2026-01-13T09:13:33+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/image/logo?v=25”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“91.97107720375061”}}
{“reqId”:“ENz9qNvg6QMXNaeUoNiG”,“level”:3,“time”:“2026-01-13T09:14:04+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark.css?plain=1&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“122.69037103652954”}}
This is one login page reload, not the login. And it really took about 2 mins.
If I had to make an educated guess, it is the user_external app. Once the session is locked, other transactions pile up.
Another contributing factor could be your session backend configuration (within your PHP installation).
And why are the times from the log almost exactly multiples of 30? And why is the login page affected, during its loading no actions regarding user_external should take place. Remember we are not talking about a login here, but simply about loading the login page.
Maybe this also helps: Server tuning — Nextcloud latest Administration Manual latest documentation
You should keep an eye on the PHP FPM workers - if you use PHP with its default configuration there are way too few workers in the pool. Also DNS lookup issues can cause sever slow downs. When the temporary delays are always 30 seconds, this sounds like some timeout.
I’m not an expert, but based on these errors, I would say this is a caching or proxy issue.
It might be too simple, but have you tried reloading the pages without cache (Ctrl+F5) or clearing the browser cache completely?
If you’re using a reverse proxy, it might also be worth checking its configuration settings, such as compression, caching and forwarded headers.