Having to log in twice

[aronmal]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I am running my own server. I am usually logged in. Since a long time, I am getting auto locked out. Should be always after about a week I think, which I do not like, but for security reasons it hasn't bothered so far. But what bothered me is, I need to login twice. I also have 2FA enabled and thought it might be because of that and when I visit:

https://mydomain.com/apps/calendar/ -> redirects to: https://mydomain.com/login?redirect_url=/apps/calendar/

So I thought it was a problem with the '?redirect_url=' part, but can't reproduce this in incognito.

I login, have to login again, 2FA code, and then being logged in. But when I do this in a incognito tab, I only have to login once plus the 2FA code. This must mean, I seem not to be fully auto logged out (?), because I only have a page refresh the first time which maybe clears my login cookies or something in that direction, so it recognizes the second login attempt?

Steps to reproduce

1. Having TOTP 2FA enabled
2. Being not logged in any more after some days due to auto logout or so
3. Try to login
4. Need to login again
5. Enter 2FA code
6. Being logged in

Expected behavior

Only having to login once and enter the 2FA code.

Installation method

Manual installation

Operating system

Debian/Ubuntu

PHP engine version

PHP 7.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

No response

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "next.mal-noh.de",
            "next.limited-dev.de"
        ],
        "dbtype": "mysql",
        "version": "23.0.4.1",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "updatechecker": true,
        "updater.release.channel": "stable",
        "maintenance": false,
        "theme": "",
        "loglevel": 0,
        "default_language": "de",
        "default_locale": "de",
        "default_phone_region": "DE",
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "tls",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 60",
        "overwrite.cli.url": "https:\/\/next.mal-noh.de"
    }
}

List of activated Apps

Enabled:
  - accessibility: 1.9.0
  - activity: 2.15.0
  - breezedark: 23.2.1
  - bruteforcesettings: 2.4.0
  - calendar: 3.2.2
  - camerarawpreviews: 0.7.15
  - circles: 23.1.1
  - cloud_federation_api: 1.6.0
  - comments: 1.13.0
  - contacts: 4.1.0
  - contactsinteraction: 1.4.0
  - cookbook: 0.9.11
  - dashboard: 7.3.0
  - dav: 1.21.0
  - external: 3.10.2
  - federatedfilesharing: 1.13.0
  - federation: 1.13.0
  - files: 1.18.0
  - files_pdfviewer: 2.4.0
  - files_rightclick: 1.2.0
  - files_sharing: 1.15.0
  - files_trashbin: 1.13.0
  - files_versions: 1.16.0
  - files_videoplayer: 1.12.0
  - integration_github: 1.0.2
  - logreader: 2.8.0
  - lookup_server_connector: 1.11.0
  - mail: 1.12.0
  - notes: 4.3.1
  - notifications: 2.11.1
  - oauth2: 1.11.0
  - onlyoffice: 7.3.2
  - password_policy: 1.13.0
  - passwords: 2022.4.10
  - photos: 1.5.0
  - privacy: 1.7.0
  - provisioning_api: 1.13.0
  - serverinfo: 1.13.0
  - settings: 1.5.0
  - sharebymail: 1.13.0
  - spreed: 13.0.5
  - support: 1.6.0
  - systemtags: 1.13.0
  - tasks: 0.14.4
  - text: 3.4.1
  - theming: 1.14.0
  - twofactor_admin: 3.2.0
  - twofactor_backupcodes: 1.12.0
  - twofactor_totp: 6.3.0
  - updatenotification: 1.13.0
  - user_status: 1.3.1
  - viewer: 1.7.0
  - weather_status: 1.3.0
  - workflowengine: 2.5.0
Disabled:
  - admin_audit
  - apporder: 0.15.0
  - encryption
  - files_external
  - firstrunwizard: 2.10.0
  - music: 1.5.1
  - nextcloud_announcements: 1.10.0
  - recommendations: 1.0.0
  - survey_client: 1.9.0
  - user_ldap

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Getting "There was an error creating your issue: body is too long (maximum is 65536 characters). " when I paste it in here. If you should really need the file I can upload it in a comment.

Additional info

No response

[ChristophWurst]

Related: #33769. See my analysis.

[ChristophWurst]

If you can, please try #33772 with the instructions from https://docs.nextcloud.com/server/latest/admin_manual/issues/applying_patch.html and report back if the added errors logs show up in your nextcloud.log.

[aronmal]

I just applied the patch and I will reach back when this bug happen again.

[aronmal]

Hey, I just actively noticed I had the bug again. I could not find a error message in my log. Here are the last 300 lines from my nextcloud.log. My login attempt was around 15:09, but since the log shows 13:05 - 13:12 I guess the time zone UTC and shifted by 2 hours.

last-log.txt

[ChristophWurst]

Please apply #33930 as well and sen your logs after you reproduce this issue the next time.

[aronmal]

I just had it happen again, here are the latest log events:

last-log.txt

But no incidence of Regenerating cookie login token for {uid} after successful verification. I thought I might need to change the log level, but it is already set to 0 (debug).

[ChristophWurst]

Restart your web server to flush the opcache

[aronmal]

OK, I restarted the container now and also the Redis container. I will let you know about the next incident.

[ChristophWurst]

Any update?

[aronmal]

Not so far.

[aronmal]

Just happen again.

last-log.txt

[ChristophWurst]

Regenerating cookie login token for is still not logged. Hmm.