Public Link used as Phone home button(widget) goes to login page instead

The Basics

  • Nextcloud Server version:
    • Nextcloud Hub 9 (30.0.6)
  • Operating system and version:
    • AIO installed in a Debian 12 LXC on Proxmox.
  • Web server and version:
    • Apache/2.4.63
  • Reverse proxy and version:
    • jc21/nginx-proxy-manager:latest
  • PHP version:
    • 8.3.17
  • Is this the first time you’ve seen this error?
    • Yes but replicated it in many situations as described below.
  • When did this problem seem to first start?
    • March 15th 2025
  • Installation method:
    • AIO
  • Are you using CloudfIare, mod_security, or similar?)
    • No

Summary of the issue you are facing:

When a public link is turned into a home screen button(widget) using the phone browser and then a user uses that button the browser page redirects to the login screen of Nextcloud rather than the Forum/Spreadsheet. The link works fine when first opened in the browser as is needed to make the home screen button and a bookmark of the link continues to work after use of the button. Behavior was confirmed on two(2) Android devices and an iPhone and when using Chrome, Firefox, Safari browsers on the phones. It was first noticed with a public link to a forum for filling and the same thing happened when testing a public link to a spreadsheet. Looking at the logs it seems like maybe the link is modified in the process of making the “home screen app” to be /apps/forms/ rather than mydomain.com/apps/forms/s/thelongfilespecificcode

Steps to replicate it (hint: details matter!):

  1. Don’t be logged into a Nextcloud account in the phone browser.
  2. Open a public link to a file/form in the phone browser. Should open normally.
  3. Use the browser ability of adding that link/page to the home screen. For Apple it is hidden in the link “share” menu and in Android it is sometimes called “add app to home screen” or add Chrome link. All different methods seem to have to same result in my testing.
  4. Click on the created “home screen app/link”

ACTUAL BEHAVIOR: a new browser tab will open on the nextcloud login page.

EXPECTED BEHAVIOR: the new tab would open to the file/form the same way it does when the link is pasted into the browser or opened from a bookmark.

notes If logged into an account with permission for the linked form the “home button” takes me to the form app page but not the “fill the form” view of the shared link. With a user logged into the browser I didn’t test the behavior with links to other types of files or a file not shared with the logged in user.

Log entries

[no app in context] Debug: Current user is not logged in
	GET /apps/forms/
	from 192.168.1.100 by -- at Mar 18, 2025, 1:45:41 AM

Nextcloud

{
  "reqId": "ADp2h7pb2gpcNauopcIt",
  "level": 0,
  "time": "2025-03-18T06:45:41+00:00",
  "remoteAddr": "192.168.1.100",
  "user": "--",
  "app": "no app in context",
  "method": "GET",
  "url": "/apps/forms/",
  "message": "Current user is not logged in",
  "userAgent": "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36",
  "version": "30.0.6.2",
  "exception": {
    "Exception": "OC\\AppFramework\\Middleware\\Security\\Exceptions\\NotLoggedInException",
    "Message": "Current user is not logged in",
    "Code": 401,
    "Trace": [
      {
        "file": "/var/www/html/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php",
        "line": 73,
        "function": "beforeController",
        "class": "OC\\AppFramework\\Middleware\\Security\\SecurityMiddleware",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Forms\\Controller\\PageController"
          },
          "index"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 106,
        "function": "beforeController",
        "class": "OC\\AppFramework\\Middleware\\MiddlewareDispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Forms\\Controller\\PageController"
          },
          "index"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/App.php",
        "line": 161,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Forms\\Controller\\PageController"
          },
          "index"
        ]
      },
      {
        "file": "/var/www/html/lib/private/Route/Router.php",
        "line": 302,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::",
        "args": [
          "OCA\\Forms\\Controller\\PageController",
          "index",
          {
            "__class__": "OC\\AppFramework\\DependencyInjection\\DIContainer"
          },
          {
            "_route": "forms.page.index"
          }
        ]
      },
      {
        "file": "/var/www/html/lib/base.php",
        "line": 1003,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->",
        "args": [
          "/apps/forms/"
        ]
      },
      {
        "file": "/var/www/html/index.php",
        "line": 24,
        "function": "handleRequest",
        "class": "OC",
        "type": "::",
        "args": []
      }
    ],
    "File": "/var/www/html/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php",
    "Line": 113,
    "message": "Current user is not logged in",
    "exception": [],
    "CustomMessage": "Current user is not logged in"
  },
  "id": "67d91696644a2"
}

Configuration

Nextcloud

{
    "system": {
        "one-click-instance": true,
        "one-click-instance.user-limit": 100,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "appsallowlist": false,
        "check_data_directory_permissions": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwritehost": "mydomain.com",
        "overwriteprotocol": "https",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "mydomain.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "30.0.6.2",
        "overwrite.cli.url": "https:\/\/mydomain.com\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "updatedirectory": "\/nc-updater",
        "loglevel": 2,
        "log_type": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "log_rotate_size": "10485760",
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "jpeg_quality": 60,
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Image",
            "2": "OC\\Preview\\MarkDown",
            "3": "OC\\Preview\\MP3",
            "4": "OC\\Preview\\TXT",
            "5": "OC\\Preview\\OpenDocument",
            "6": "OC\\Preview\\Movie",
            "7": "OC\\Preview\\Krita",
            "0": "OC\\Preview\\Imaginary",
            "23": "OC\\Preview\\ImaginaryPDF"
        },
        "enable_previews": true,
        "upgrade.disable-web": true,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": "30",
        "simpleSignUpLink.shown": false,
        "share_folder": "\/Shared",
        "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
        "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726",
        "allow_local_remote_servers": true,
        "davstorage.request_timeout": 3600,
        "htaccess.RewriteBase": "\/",
        "dbpersistent": false,
        "files_external_allow_create_new_local": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": 1,
        "mail_sendmailmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/exiftool-amd64-musl",
        "memories.vod.path": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/go-vod-amd64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "maintenance_window_start": 100,
        "auth.bruteforce.protection.enabled": true,
        "ratelimit.protection.enabled": true,
        "preview_imaginary_key": "***REMOVED SENSITIVE VALUE***",
        "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425",
        "default_phone_region": "US",
        "DOMAIN": "mydomain.com"
    }
}

Apps

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - announcementcenter: 7.1.0
  - app_api: 4.0.6
  - appointments: 2.3.6
  - assistant: 2.4.0
  - bookmarks: 15.1.0
  - bruteforcesettings: 3.0.0
  - calendar: 5.1.2
  - call_summary_bot: 2.0.1
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - collectives: 2.16.1
  - comments: 1.20.1
  - contacts: 7.0.1
  - contactsinteraction: 1.11.0
  - context_chat: 4.1.0
  - cookbook: 0.11.2
  - cospend: 3.0.11
  - dashboard: 7.10.0
  - dav: 1.31.1
  - deck: 1.14.4
  - end_to_end_encryption: 1.16.2
  - event_update_notification: 2.6.1
  - external: 5.5.2
  - externalportal: 1.3.1
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_antivirus: 5.6.1
  - files_downloadlimit: 3.0.0
  - files_fulltextsearch: 31.0.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_snapshots: 1.0.10
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - files_zip: 2.1.0
  - firstrunwizard: 3.0.0
  - forms: 5.0.2
  - fulltextsearch: 30.0.1
  - fulltextsearch_elasticsearch: 30.0.1
  - gestion: 2.6.3
  - gpoddersync: 3.12.0
  - group_default_quota: 0.1.10
  - groupfolders: 18.1.0
  - guests: 4.2.0
  - impersonate: 1.17.1
  - integration_google: 3.1.1
  - integration_openstreetmap: 2.0.1
  - intros: 1.0.2
  - keeporsweep: 0.3.0
  - login_notes: 1.6.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.2.2
  - maps: 1.5.0
  - memories: 7.5.2
  - metadata: 0.21.0
  - money: 0.29.1
  - multiboards: 1.0.4
  - news: 25.2.1
  - nextcloud-aio: 0.7.0
  - nextcloud_announcements: 2.0.0
  - notes: 4.11.0
  - notifications: 3.0.0
  - notify_push: 1.0.0
  - oauth2: 1.18.1
  - ownershiptransfer: 1.1.0
  - password_policy: 2.0.0
  - photos: 3.0.2
  - polls: 7.3.2
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - quota_warning: 1.21.0
  - recognize: 8.2.0
  - recommendations: 3.0.0
  - registration: 2.6.0
  - related_resources: 1.5.0
  - repod: 3.5.5
  - richdocuments: 8.5.4
  - riotchat: 0.18.7
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - sharereview: 1.3.3
  - side_menu: 4.0.1
  - sketch_picker: 2.1.0
  - skyprint: 0.1.6
  - spreed: 20.1.4
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - tables: 0.9.0
  - tasks: 0.16.1
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - uppush: 2.2.5
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - whiteboard: 1.0.5
  - workflow_kitinerary: 1.6.0
  - workflowengine: 2.12.0
  - workspace: 4.0.1
Disabled:
  - encryption: 2.18.0
  - files_external: 1.22.0
  - phonetrack: 0.8.2 (installed 0.8.2)
  - suspicious_login: 8.0.0
  - talk_matterbridge: 1.31.1026000 (installed 1.31.1026000)
  - timemanager: 0.3.17 (installed 0.3.17)
  - timetracker: 0.0.84 (installed 0.0.84)
  - user_ldap: 1.21.0

First post here so hope I got things right and I am happy to dig into things more as needed

I also have the same behaviour with links on the Android. When I open a link, even the old page is stopped. The necessary cookies are probably always lost. This is probably standard behaviour.

You could try saving the link as a bookmark directly in the normal Android browser e.g. Chrome. Then open the browser e.g. Chrome directly and use the bookmark.

Helpful to know that you also saw the same effect because that means my specific setup configuration is probably not the problem. I don’t think cookies are the issue (1) because it is a public link so there should be no need for cookie info to view the form, (2) for me a separate tab of the same browser will work at the same time that the “widget” opened tab doesn’t.

Yes my current work around is to just use bookmarks and they work fine. The home screen “widgets” are really nice for my use case though where I want folks to have a really easy way to regularly go to the form, used to collect vehicle trip mileage info.

Sorry. But public links without authentication work for me. Test in normal browser with no user is logged in.