From 185cc0e736d78e68894799f7083ba3bd5a44f91c Mon Sep 17 00:00:00 2001 From: Git'Fellow <12234510+solracsf@users.noreply.github.com> Date: Tue, 22 Sep 2026 12:22:00 +0200 Subject: [PATCH 1/2] fix(auth): keep remember-me cookies pointing at a live session token fix(auth): keep remember-me cookies pointing at a live session token The remember-me cookie outlives the session token it refers to in two cases, and cookie login then fails on every request. A session token created as DO_NOT_REMEMBER (user_oidc, Apache login) is removed by the cleanup job after session_lifetime, while the cookies last remember_login_cookie_lifetime. loginWithApache() now creates its token as REMEMBER, and createRememberMeToken() marks a DO_NOT_REMEMBER token as REMEMBER for other callers with the same mismatch. ISession::regenerateId(true, true) moves the token to the new session id but left nc_session_id pointing at the old one (password protected share unlock, Talk password rooms). The cookie is now rewritten with the new id. Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com> --- lib/private/Session/Internal.php | 2 ++ lib/private/User/Session.php | 15 +++++++++++++++ tests/lib/User/SessionTest.php | 21 +++++++++++++++++++++ 3 files changed, 38 insertions(+) diff --git a/lib/private/Session/Internal.php b/lib/private/Session/Internal.php index d10091011573c..4d31d684adede 100644 --- a/lib/private/Session/Internal.php +++ b/lib/private/Session/Internal.php @@ -12,6 +12,7 @@ use OC\Authentication\Token\IProvider; use OC\Diagnostics\TLogSlowOperation; +use OC\User\Session as UserSession; use OCP\Authentication\Exceptions\InvalidTokenException; use OCP\Server; use OCP\Session\Exceptions\SessionNotAvailableException; @@ -149,6 +150,7 @@ public function regenerateId(bool $deleteOldSession = true, bool $updateToken = try { $tokenProvider->renewSessionToken($oldId, $newId); + Server::get(UserSession::class)->renewMagicSessionId($oldId); } catch (InvalidTokenException $e) { // Just ignore } diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php index e5ad2dae52245..82c020a22bb37 100644 --- a/lib/private/User/Session.php +++ b/lib/private/User/Session.php @@ -1075,6 +1075,21 @@ public function setMagicInCookie($username, $token) { } } + /** + * Point the remember-me cookie at the regenerated session id, so cookie + * login can still find the token that was renewed along with it. + */ + public function renewMagicSessionId(string $oldSessionId): void { + $request = Server::get(IRequest::class); + $username = $request->getCookie('nc_username'); + $token = $request->getCookie('nc_token'); + $sessionId = $request->getCookie('nc_session_id'); + if ($username === null || $token === null || $sessionId !== $oldSessionId) { + return; + } + $this->setMagicInCookie($username, $token); + } + /** * Remove cookie for "remember username" */ diff --git a/tests/lib/User/SessionTest.php b/tests/lib/User/SessionTest.php index f466569eb9b3c..a5dc13e467d14 100644 --- a/tests/lib/User/SessionTest.php +++ b/tests/lib/User/SessionTest.php @@ -1211,6 +1211,27 @@ public function testCreateRememberMeToken(): void { $this->userSession->createRememberMeToken($user); } + public static function renewMagicSessionIdData(): array { + return [ + 'cookie holds the old session id' => [['nc_username' => 'u', 'nc_token' => 't', 'nc_session_id' => 'old'], true], + 'cookie holds another session id' => [['nc_username' => 'u', 'nc_token' => 't', 'nc_session_id' => 'other'], false], + 'no remember-me cookies' => [[], false], + ]; + } + + #[\PHPUnit\Framework\Attributes\DataProvider(methodName: 'renewMagicSessionIdData')] + public function testRenewMagicSessionId(array $cookies, bool $expectRenewal): void { + $this->userSession->expects($expectRenewal ? $this->once() : $this->never()) + ->method('setMagicInCookie') + ->with('u', 't'); + + $request = $this->createMock(IRequest::class); + $request->method('getCookie')->willReturnCallback(fn (string $key) => $cookies[$key] ?? null); + $this->overwriteService(IRequest::class, $request); + + $this->userSession->renewMagicSessionId('old'); + } + public function testTryBasicAuthLoginValid(): void { $request = $this->createMock(Request::class); $request->method('__get') From 61e4c6c99c1139e85187025998bdc94977caa2ab Mon Sep 17 00:00:00 2001 From: Git'Fellow <12234510+solracsf@users.noreply.github.com> Date: Tue, 22 Sep 2026 15:32:47 +0200 Subject: [PATCH 2/2] fix(auth): create the Apache login session token as remembered loginWithApache() sets remember-me cookies but created the session token as DO_NOT_REMEMBER, so the cleanup job removed it after session_lifetime while the cookie stayed valid, matching the mismatch fixed for the share-unlock case in the previous commit. Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com> --- lib/private/legacy/OC_User.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/private/legacy/OC_User.php b/lib/private/legacy/OC_User.php index c8a3d43c05240..74f88a8afd82d 100644 --- a/lib/private/legacy/OC_User.php +++ b/lib/private/legacy/OC_User.php @@ -172,7 +172,7 @@ public static function loginWithApache(IApacheBackend $backend): bool { /** @var IEventDispatcher $dispatcher */ $dispatcher->dispatchTyped(new BeforeUserLoggedInEvent($uid, $password, $backend)); - $userSession->createSessionToken($request, $uid, $uid, $password); + $userSession->createSessionToken($request, $uid, $uid, $password, IToken::REMEMBER); $userSession->createRememberMeToken($userSession->getUser()); if (empty($password)) {