Nextcloud suddenly starts sending 401

I’m struggeling with this issue for a long time now without any solution.

My nextcloud server is running as docker container, with nginx-proxy and proxy-companion for letsencrypt certificates.

Unfortunately the server keeps logging out all users regularly unconditionally.

Looking to the server logs, the only thing I find is that everything’s working find but suddenly it starts logging this error:

"Exception": "Sabre\\DAV\\Exception\\NotAuthenticated",
"Message": "No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured"

This happens on all clients, no matter if it’s the windows client, Android or iOS client. So I am sure it’s no client issue.

I recorded a session on my laptop with fiddler. This shows to me that from the one second to the other 401 errors are returned - I cannot determine why.

As you can see in the screenshot, there are many PROPFINDs answered with 207 and suddenly it turns to 401:
2021-01-25 20_55_48-Clipboard

Looking to the request headers it’s visible that absolutely nothing regarding authorization etc. changed from the last working request to the denied request. There is a Basic auth header present which doesn’t change from the last working to the denied request.

This is the respective log entry of the given first 401 report:

{
  "reqId": "lMsaIitk0Qcqp1C475xt",
  "level": 0,
  "time": "2021-01-25T19:31:33+00:00",
  "remoteAddr": "91.42.20.11",
  "user": "--",
  "app": "webdav",
  "method": "PROPFIND",
  "url": "/remote.php/dav/files/peez/",
  "message": {
    "Exception": "Sabre\\DAV\\Exception\\NotAuthenticated",
    "Message": "No public access to this resource., Username or password was incorrect, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, Username or password was incorrect",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
        "line": 89,
        "function": "beforeMethod",
        "class": "Sabre\\DAV\\Auth\\Plugin",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 458,
        "function": "emit",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "beforeMethod:PROPFIND",
          [
            {
              "__class__": "Sabre\\HTTP\\Request"
            },
            {
              "__class__": "Sabre\\HTTP\\Response"
            }
          ]
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 251,
        "function": "invokeMethod",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 319,
        "function": "start",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/apps/dav/lib/Server.php",
        "line": 332,
        "function": "exec",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/apps/dav/appinfo/v2/remote.php",
        "line": 35,
        "function": "exec",
        "class": "OCA\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/html/remote.php",
        "line": 167,
        "args": [
          "/var/www/html/apps/dav/appinfo/v2/remote.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php",
    "Line": 161,
    "CustomMessage": "--"
  },
  "userAgent": "Mozilla/5.0 (Windows) mirall/3.1.1stable-Win64 (build 20201222) (Nextcloud)",
  "version": "20.0.4.0"
}

After a re-login, it’s working for some time but then - after a unpredictable time - the users are thrown out again.

Do you have any idea what could be happening here?

Try disabling external storage app, or other apps, one by one, to detemine which one might be the cause.

You could provide some more detail on host and setup, run ncp-config>System> nc-info or exec ncp-report from terminal, inside container.

Thanks for your tips!
I now disabled all plugins I can spare - let’s see if it changes anything. The remaining plugins are now:
Bookmarks, Deleted Files, Filesharing, Versions.

regarding that ncp-report, I tried to execute it from within the container but there seems to be no command named like this.
2021-01-26 15_31_41-peez@freundx_ ~

My bad, I presumed you’re using ncp (it was tagged ncp), looks like you are using another container image? If so which one?

Sorry I just chose the “docker” tag as I wasn’t aware that there is some “ncp” appliance :wink:

I’m using the standard image from docker hub, currently nextcloud:20.0.6-apache, with an jwilder/nginx-proxy and the jrcs/letsencrypt-nginx-proxy-companion.

OK I had it running for some time now, unfortunately the issue is not gone. Nextcloud client icon unintentionally turns grey after some random amount of time.

Any more ideas? :wink:

Meanwhile I sniffed a bit by putting mitmproxy before nextcloud. Unfortunately I didn’t get no step further.
In contrast to the error message, there is always a Basic auth header in the request.
And the header is 100% the same as in the succeeding request just some milliseconds before.

What I found is that the basic auth header the sync client is using is kinda different to what I know as “Basic Auth” header. I know Basic Auth Header as Authorization: Basic <base64(username:password)>.
The Basic Auth Header I can see is something strange, base64-decoded it looks like Authorization: Basic <base64(username:base64(somethingbinary))>

Besides this I also saw that other WebDav clients seem to use a traditional Basic Auth Header.

Might this be some trace to the root cause or is nextcloud handling Basic Auth headers from Sync Client kinda differently?