Nextcloud site constantly reloading due to token refresh

[dan0v]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Ever since #1391, Nextcloud often reloads the page, losing any progress in whatever was being worked on.

Steps to reproduce

1. Log in using an OIDC IDP with the store_login_token option enabled (used Authentik).
2. Wait the isExpiring() threshold duration.
3. Lose any in-progress work on your current page (any app which does not constantly silently save progress), as Nextcloud reloads and goes through the token exchange flow.

Expected behaviour

In-progress work should not be lost and the focused page should not arbitrarily redirect away if possible...

Behaviour this invasive should at least come with a separate toggle in the UI and a warning message.

Actual behaviour

After the token refresh timeout, even if the user is working on something, a browser redirection flow begins to

1. /login?redirect_url=...
2. /apps/user_oidc/login/1?redirectUrl=...
3. https://idp..../application/o/authorize/?...
4. /apps/user_oidc/code?...&state=...

before finally landing back on the current page url, with any previous unsaved work in progress on that page lost in the process.

Server configuration

Web server: docker nextcloud:apache

Database: PostgreSQL

PHP version: 8.4

Nextcloud version: 33.0.4

Browser

Browser name: Firefox

Browser version: 151.0.2

Operating system: Fedora 44

IDP: Authentik

[Benny7623]

+1 here:

one of our admin users has a similar Problem after migrating to user_oidc from sociallogin:

when he's logged in and opens the User Settings Page (called "Konten" in German) and tries to edit a User to change his Groups for example: the Page reloads before he can make any changes.

Other Users don't have this Error. I'm trying to figure out what's different for this user and will give more Information if I find something supicious.

Our Netcloud Version is 33.0.5 and we tried it from Firefox and Chrome Browser, also on different Operating Systems: Windows 10 and Arch Linux.

Interesting is, that there really seems to be a Problem with the User, because, as already mentioned above, other Users don't have this Problem, and we tried it on an Arch Linux from Firefox with the affected user, where the Problem existed, but with the same Browser and Operating System on the same Device logged in with another User the Problem didn't appear.

[solracsf]

Feel free to patch and test with #1450
Feedback is very welcome!

[johnnnybuoy]

Just chiming in to say it seems like I'm having the same issue

Server configuration

Web server: Docker - nextcloud:33.0.5-apache
Database: MariaDB 11.8
PHP version: 8.4.22
Nextcloud version: 33.0.5

Browser

Browser name: Zen (Firefox)
Browser version: 151.0.3
Operating system: Arch Linux
IDP: Authentik

I managed to record the issue happening

nextcloud.reloading.mp4

Here's the console logs

[WARN] core: User session was terminated, forwarding to login page. 
Object { app: "core", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2944050
[DEBUG] core: Browser storages cleared 
Object { app: "core", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943918
[INFO] activity: Activity API registered 
Object { app: "activity", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
index-NjYp13Ld.chunk.mjs:4:243
[DEBUG] @nextcloud/files: New sidebar tab with id "files_versions" registered. 
Object { app: "@nextcloud/files", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
index-DqIuD5e7.chunk.mjs:4:176
[WARN] viewer: Some mimes were ignored because they are not enabled in the server previews config 
Object { app: "viewer", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0, ignoredMimes: (3) […] }
previewUtils-Dqoyaeqv.chunk.mjs:5:313
[DEBUG] viewer: OCA.Viewer initialized 
Object { app: "viewer", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
previewUtils-Dqoyaeqv.chunk.mjs:5:177
[DEBUG] core: Unified search initialized! 
Object { app: "core", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943918
[INFO] viewer: No OCP.Files app found, viewer is now in standalone mode 
Object { app: "viewer", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
previewUtils-Dqoyaeqv.chunk.mjs:5:246
[DEBUG] @nextcloud/files: New sidebar tab with id "activity" registered. 
Object { app: "@nextcloud/files", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
index-NjYp13Ld.chunk.mjs:4:176
[DEBUG] comments: OCA.Comments.View initialized 
Object { app: "comments", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943918
[DEBUG] files_sharing: OCA.Sharing.ShareSearch initialized 
Object { app: "files_sharing", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943918
[DEBUG] files_sharing: OCA.Sharing.ExternalShareActions initialized 
Object { app: "files_sharing", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943918
[DEBUG] @nextcloud/files: New sidebar tab with id "sharing" registered. 
Object { app: "@nextcloud/files", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943918
[ERROR] viewer: Could not register handler 
Object { app: "viewer", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0, error: "The handler is already registered", handler: {…} }
previewUtils-Dqoyaeqv.chunk.mjs:5:381
[INFO] viewer: 6 viewer handlers registered 
Object { app: "viewer", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0, handlers: (6) […] }
previewUtils-Dqoyaeqv.chunk.mjs:5:246
[INFO] core: session heartbeat polling started 
Object { app: "core", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943985
[WARN] @nextcloud/vue: You need to fill either the text or the ariaLabel props in the button component. 
Object { uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", app: "@nextcloud/vue", level: 0, text: undefined, ariaLabel: null, instance: {…} }
core-common.js:1:2944050
[WARN] @nextcloud/vue: You need to fill either the text or the ariaLabel props in the button component. 
Object { uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", app: "@nextcloud/vue", level: 0, text: undefined, ariaLabel: null, instance: {…} }
core-common.js:1:2944050
[DEBUG] activity: Registered new sidebar action 
Object { app: "activity", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
index-NjYp13Ld.chunk.mjs:4:176
[DEBUG] activity: Registered new sidebar actions factory 
Object { app: "activity", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
index-NjYp13Ld.chunk.mjs:4:176
[INFO] comments: Comments plugin registered for Activity sidebar action 
Object { app: "comments", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943985
Notifications permissions granted NotificationsApp-iD1fLC7v.chunk.mjs:86:58933
Polling interval updated to 30000 NotificationsApp-iD1fLC7v.chunk.mjs:86:58364
Started background fetcher as session_keepalive is enabled NotificationsApp-iD1fLC7v.chunk.mjs:86:55524
[DEBUG] core: this browser is officially supported ! 🚀 
Object { app: "core", uid: "5cedacbd4cef75a9c2c474f91ec55904110c480813c3b4c8c51688dbdbcdd03e", level: 0 }
core-common.js:1:2943918
Got notification data, restoring default polling interval. NotificationsApp-iD1fLC7v.chunk.mjs:86:57319

It seems to be happening almost exactly every five minutes (the "Application authorized" actions are Nextcloud reloading)

@solracsf, I tried your patch but these screenshots/captures are after applying it, so it doesn't seem to have fixed it

[solracsf]

@johnnnybuoy #1450 has been updated, can you apply it?

Also, reload your PHP after applying it, and activate debug mode on your Nextcloud.

Debug lines will be necessary if problem remains (the patch will log them).

[johnnnybuoy]

@solracsf - I've tried the updated patch, but the issue still seems to occur

Just in case I'm doing it wrong, I'm applying the patch like so

1. Download modified files from patch (i.e. just TokenService.php in this case)
2. Replace files in /var/www/html/custom_apps/user_oidc with modified files (in the container)
3. Run docker compose up -d --force-recreate

Here are the Nextcloud logs from the time of these events (with log level set to "Debug", and a bit of padding before/after)

[solracsf]

https://docs.nextcloud.com/server/stable/admin_manual/issues/applying_patch.html

[johnnnybuoy]

Thank you. Applied the patch properly but the issue's still present

Login at 17:47:05 and reload at 17:52:09-10
nextcloud.log

[solracsf]

Before proceeding, can you ensure the offline_access scope mapping is available by adding authentik default OAuth Mapping: OpenID 'offline_access' to the selected scopes?

The offline_access scope in Authentik allows applications to obtain a refresh token, enabling them to access user data even when the user is not actively logged in. This is essential for maintaining user sessions without requiring repeated logins.

[johnnnybuoy]

offline_access was not added previously, but after doing so the issue persists. Made sure to log out, of both Nextcloud and Authentik, and back in

From login to reload again
nextcloud.log

[solracsf]

Forgot to mention that it must also be added Nextcloud side:
Scope to openid email profile offline_access (and others, depending on your config)

Beside that, I'm testing against Keycloack actually; I'm going to deploy an Authentik container to try to reproduce it in full.
Stand-by.

[solracsf]

Bottom line:

• Enable offline_access in both Authentik and Nextcloud scope : it's the right config, and makes session keep-alive actually work (turns the bug from "constant" into "never" for normal sequential use).
• The final fix is at fix(token): prevent reload loop from refresh-token rotation race #1450 : for deployments that can't or don't issue refresh tokens (the misclassification > no-logout-on-background fix), and for the concurrent rotation race (the dedup fix). offline_access and the code fix are complementary, not alternatives.

Verified on Keycloak and Authentik.

[johnnnybuoy]

Love your work solracsf! Can confirm enabling the offline_access scope in Authentik and Nextcloud, and applying the patch from #1450, has resolved the issue (for me at least)! No reloads in 10 minutes