Request does not pass strict cookie check iOS

I’m getting a lot more “Request does not pass strict cookie check” errors since I upgraded to NC 31. It seems to happen most often on iOS and with publicly shared links.

{
  "reqId": "CgN9Wqoz3Ad",
  "level": 2,
  "time": "2025-04-11T19:20:14+00:00",
  "remoteAddr": « IP »,
  "user": false,
  "app": "no app in context",
  "method": "GET",
  "url": "/public.php/dav/files/HARW893UOilbM/?accept=zip",
  "message": "Request does not pass strict cookie check",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36",
  "version": "31.0.3.2",
  "data": [],
  "id": "67f9718ff2bf8"
}

Thanks.

I am having th same issue when trying to access nextcloud through solid explorer (Android App) no matter wether if i try using WebDAV or the nexcloud integration.

{
  "reqId": "aAjRY5-khH-cnA3-09SjFwAAAFM",
  "level": 2,
  "time": "2025-04-23T11:39:15+00:00",
  "remoteAddr": "172.16.0.62",
  "user": "Thor",
  "app": "no app in context",
  "method": "PROPFIND",
  "url": "/remote.php/webdav/Documents/",
  "message": "Request does not pass strict cookie check",
  "userAgent": "SolidExplorer/2.0",
  "version": "31.0.4.1",
  "data": [],
  "id": "6808d30403729"
}

I saw this post and try to add the 'csrf.optout' but it didn’t solve it.

with this log I am also getting the following one:

{
  "reqId": "aAjWrJ-khH-cnA3-09SjtgAAAEA",
  "level": 0,
  "time": "2025-04-23T12:01:49+00:00",
  "remoteAddr": "172.16.0.62",
  "user": false,
  "app": "webdav",
  "method": "PROPFIND",
  "url": "/remote.php/dav/files/Thor/",
  "message": "No public access to this resource., AppAPIAuth has not passed, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured",
  "userAgent": "SolidExplorer/2.0",
  "version": "31.0.4.1",
  "exception": {
    "Exception": "Sabre\\DAV\\Exception\\NotAuthenticated",
    "Message": "No public access to this resource., AppAPIAuth has not passed, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
        "line": 89,
        "function": "beforeMethod",
        "class": "Sabre\\DAV\\Auth\\Plugin",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 456,
        "function": "emit",
        "class": "Sabre\\DAV\\Server",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php",
        "line": 49,
        "function": "invokeMethod",
        "class": "Sabre\\DAV\\Server",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/dav/lib/Server.php",
        "line": 398,
        "function": "start",
        "class": "OCA\\DAV\\Connector\\Sabre\\Server",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/dav/appinfo/v2/remote.php",
        "line": 21,
        "function": "exec",
        "class": "OCA\\DAV\\Server",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/remote.php",
        "line": 145,
        "args": [
          "/var/www/nextcloud/apps/dav/appinfo/v2/remote.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php",
    "Line": 152,
    "message": "No public access to this resource., AppAPIAuth has not passed, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured",
    "exception": [],
    "CustomMessage": "No public access to this resource., AppAPIAuth has not passed, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured"
  },
  "id": "6808d6ae55a66"
1 Like

Any luck? I also tried using that post as a template for adding an exception to my config, but it definitely doesn’t seem to have worked.

I left it on default, and it comes and goes randomly… Let me know if you find any solution. I don’t have much time currently to troubleshoot it