From 1c9e5205f97ee0ff88cf72d5ee63535956d72d71 Mon Sep 17 00:00:00 2001
From: Git'Fellow <12234510+solracsf@users.noreply.github.com>
Date: Tue, 22 Sep 2026 12:22:00 +0200
Subject: [PATCH] fix(auth): keep remember-me cookies pointing at a live
 session token

The remember-me cookie outlives the session token it refers to in two
cases, and cookie login then fails on every request.

A session token created as DO_NOT_REMEMBER (user_oidc, Apache login) is
removed by the cleanup job after session_lifetime, while the cookies last
remember_login_cookie_lifetime. loginWithApache() now creates its token
as REMEMBER, and createRememberMeToken() marks a DO_NOT_REMEMBER token
as REMEMBER for other callers with the same mismatch.

ISession::regenerateId(true, true) moves the token to the new session id
but left nc_session_id pointing at the old one (password protected share
unlock, Talk password rooms). The cookie is now rewritten with the new id.

Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>
---
 lib/private/Session/Internal.php |  2 ++
 lib/private/User/Session.php     | 15 +++++++++++++++
 lib/private/legacy/OC_User.php   |  2 +-
 tests/lib/User/SessionTest.php   | 21 +++++++++++++++++++++
 4 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/lib/private/Session/Internal.php b/lib/private/Session/Internal.php
index d10091011573c..4d31d684adede 100644
--- a/lib/private/Session/Internal.php
+++ b/lib/private/Session/Internal.php
@@ -12,6 +12,7 @@
 
 use OC\Authentication\Token\IProvider;
 use OC\Diagnostics\TLogSlowOperation;
+use OC\User\Session as UserSession;
 use OCP\Authentication\Exceptions\InvalidTokenException;
 use OCP\Server;
 use OCP\Session\Exceptions\SessionNotAvailableException;
@@ -149,6 +150,7 @@ public function regenerateId(bool $deleteOldSession = true, bool $updateToken =
 
 			try {
 				$tokenProvider->renewSessionToken($oldId, $newId);
+				Server::get(UserSession::class)->renewMagicSessionId($oldId);
 			} catch (InvalidTokenException $e) {
 				// Just ignore
 			}
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index e07ddec38df61..3bbefd7199fa1 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -1073,6 +1073,21 @@ public function setMagicInCookie($username, $token) {
 		}
 	}
 
+	/**
+	 * Point the remember-me cookie at the regenerated session id, so cookie
+	 * login can still find the token that was renewed along with it.
+	 */
+	public function renewMagicSessionId(string $oldSessionId): void {
+		$request = Server::get(IRequest::class);
+		$username = $request->getCookie('nc_username');
+		$token = $request->getCookie('nc_token');
+		$sessionId = $request->getCookie('nc_session_id');
+		if ($username === null || $token === null || $sessionId !== $oldSessionId) {
+			return;
+		}
+		$this->setMagicInCookie($username, $token);
+	}
+
 	/**
 	 * Remove cookie for "remember username"
 	 */
diff --git a/lib/private/legacy/OC_User.php b/lib/private/legacy/OC_User.php
index 63217b1b930b7..9bbdc305a0a3c 100644
--- a/lib/private/legacy/OC_User.php
+++ b/lib/private/legacy/OC_User.php
@@ -165,7 +165,7 @@ public static function loginWithApache(IApacheBackend $backend): bool {
 
 				$dispatcher->dispatchTyped(new BeforeUserLoggedInEvent($uid, $password, $backend));
 
-				$userSession->createSessionToken($request, $uid, $uid, $password);
+				$userSession->createSessionToken($request, $uid, $uid, $password, IToken::REMEMBER);
 				$userSession->completeLogin(
 					$user,
 					['loginName' => $uid, 'password' => $password ?? ''],
diff --git a/tests/lib/User/SessionTest.php b/tests/lib/User/SessionTest.php
index 00342ad751534..20348f63cde34 100644
--- a/tests/lib/User/SessionTest.php
+++ b/tests/lib/User/SessionTest.php
@@ -1214,6 +1214,27 @@ public function testCreateRememberMeToken(): void {
 		$this->userSession->createRememberMeToken($user);
 	}
 
+	public static function renewMagicSessionIdData(): array {
+		return [
+			'cookie holds the old session id' => [['nc_username' => 'u', 'nc_token' => 't', 'nc_session_id' => 'old'], true],
+			'cookie holds another session id' => [['nc_username' => 'u', 'nc_token' => 't', 'nc_session_id' => 'other'], false],
+			'no remember-me cookies' => [[], false],
+		];
+	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider(methodName: 'renewMagicSessionIdData')]
+	public function testRenewMagicSessionId(array $cookies, bool $expectRenewal): void {
+		$this->userSession->expects($expectRenewal ? $this->once() : $this->never())
+			->method('setMagicInCookie')
+			->with('u', 't');
+
+		$request = $this->createMock(IRequest::class);
+		$request->method('getCookie')->willReturnCallback(fn (string $key) => $cookies[$key] ?? null);
+		$this->overwriteService(IRequest::class, $request);
+
+		$this->userSession->renewMagicSessionId('old');
+	}
+
 	public function testTryBasicAuthLoginValid(): void {
 		$request = $this->createMock(Request::class);
 		$request->method('__get')