Authorization by bearer token fails on some servers (Floccus E019; HTTP status 405)

Describe the bug

This is a formalisation of my comments in https://github.com/floccusaddon/floccus/issues/2200
For effected floccus users, see: https://github.com/floccusaddon/floccus/issues/2200#issuecomment-4106966015

Protected API requests to the bookmarks API will fail if a server-supplied bearer token is used and no other valid authorisation is presented (i.e: session cookies). This behaviour only appears to effect some Nextcloud installations.

This bug only manifested after upgrading to Nextcloud 31/32

Steps to Reproduce

1. Identify an effected Nextcloud server (as reported by @marcelklehr, this does not effect all installations)
2. Create a profile in Floccus to sync from the effected server
3. Floccus will immediately attempt to sync once the profile has been created
   3.1. Floccus will successfully lock the API using basic authorization
   3.2. Floccus will list the root folder of the user's bookmarks (GET /index.php/apps/bookmarks/public/rest/v2/folder?root=-1&layers=0
   3.3. Floccus will save the bearer token received from the server when it requested the contents of the root folder
   3.4. Floccus will make a subsequent request (may be another folder request, or something else) with the saved bearer token
   3.5. Bookmarks will not recognize the bearer token it supplied to the client, and if the client has no other valid authorisation such as cookies, will refuse to route the request to the bookmarks api, returning HTTP 405. (GET /index.php/apps/bookmarks/public/rest/v2/folder?root=12&layers=0)
4. Floccus will report E019: HTTP status 405. Failed GET request.

Known Effected Clients:

• Flatpak Ungoogled Chromium 146.0.7680.80 with Floccus 5.8.6
• macOS Ungoogled Chromium 146.0.7680.80 with Floccus 5.8.0

Uneffected Clients:

• iOS Floccus 5.8.6

Server Information

• OS: Fedora Server 42
• HTTP server: nginx 1.28.2
• Database: MariaDB 10.11.16
• PHP version: 8.4.19
• Nextcloud version: Nextcloud 32.0.6 (initially Nextcloud 26 via webinstall)
• Bookmarks app version: 16.1.3
• Nextcloud external user backend: user_oidc
• Activated Nextcloud Apps: see below
• Nextcloud configuration: see below

Activated Nextcloud Apps

Enabled:
  - activity: 5.0.0
  - admin_audit: 1.22.0
  - announcementcenter: 7.3.0
  - app_api: 32.0.0
  - bookmarks: 16.1.3
  - bruteforcesettings: 5.0.0
  - calendar: 6.2.1
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.3.4
  - dav: 1.34.2
  - federatedfilesharing: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - logreader: 5.0.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0
  - notes: 4.13.0
  - notifications: 5.0.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0
  - passwords: 2026.2.20
  - photos: 5.0.0
  - privacy: 4.0.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0
  - related_resources: 3.0.0
  - serverinfo: 4.0.0
  - settings: 1.15.1
  - spreed: 22.0.9
  - systemtags: 1.22.0
  - tasks: 0.17.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_oidc: 5.0.2
  - user_status: 1.12.0
  - viewer: 5.0.0
  - workflowengine: 2.14.0

Nextcloud Configuration:

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "32.0.6.1",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "defaultapp": "announcementcenter,files",
        "default_phone_region": "GB",
        "auth.webauthn.enabled": false,
        "lost_password_link": "disabled",
        "allow_local_remote_servers": true,
        "maintenance_window_start": 22,
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "maintenance": false,
        "theme": "",
        "loglevel": 1,
        "app_install_overwrite": [
            "user_oidc"
        ]
    }
}

Logs

This issue does not generate any relevant errors or logs to nextcloud.log or to php.

Web Server Error Log

nextcloud_user [23/Mar/2026:21:48:54 +0000] "GET /ocs/v2.php/cloud/capabilities?format=json HTTP/1.1" 200 3407 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:48:54 +0000] "POST /index.php/apps/bookmarks/public/rest/v2/lock HTTP/1.1" 200 206 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:48:54 +0000] "GET /index.php/apps/bookmarks/public/rest/v2/folder?root=-1&layers=0 HTTP/1.1" 200 336 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
- [23/Mar/2026:21:48:55 +0000] "GET /index.php/apps/bookmarks/public/rest/v2/folder?root=12&layers=0 HTTP/1.1" 405 5 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:48:55 +0000] "DELETE /index.php/apps/bookmarks/public/rest/v2/lock HTTP/1.1" 200 206 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:49:11 +0000] "GET /ocs/v2.php/cloud/capabilities?format=json HTTP/1.1" 200 3407 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:49:11 +0000] "POST /index.php/apps/bookmarks/public/rest/v2/lock HTTP/1.1" 200 207 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:49:11 +0000] "GET /index.php/apps/bookmarks/public/rest/v2/folder?root=-1&layers=0 HTTP/1.1" 200 336 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
- [23/Mar/2026:21:49:11 +0000] "GET /index.php/apps/bookmarks/public/rest/v2/folder?root=12&layers=0 HTTP/1.1" 405 5 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
- [23/Mar/2026:21:49:11 +0000] "DELETE /index.php/apps/bookmarks/public/rest/v2/lock HTTP/1.1" 405 5 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:49:12 +0000] "GET /ocs/v2.php/cloud/capabilities?format=json HTTP/1.1" 200 3407 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:49:12 +0000] "POST /index.php/apps/bookmarks/public/rest/v2/lock HTTP/1.1" 423 328 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
nextcloud_user [23/Mar/2026:21:49:14 +0000] "GET /ocs/v2.php/cloud/capabilities?format=json HTTP/1.1" 200 3407 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"

Nextcloud log (nextcloud/data/nextcloud.log)

{"reqId":"ryzRWnE8Qf9dLt58Y3e5","level":1,"time":"2026-03-23T21:54:00+00:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"nextcloud_user","app":"no app in context","method":"GET","url":"/ocs/v2.php/cloud/capabilities?format=json","scriptName":"/ocs/v2.php","message":"The user config key files/quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36","version":"32.0.6.1","data":[]}
{"reqId":"fESx2EiMpIMqgbx795nm","level":1,"time":"2026-03-23T21:54:34+00:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"nextcloud_user","app":"no app in context","method":"GET","url":"/ocs/v2.php/cloud/capabilities?format=json","scriptName":"/ocs/v2.php","message":"The user config key files/quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36","version":"32.0.6.1","data":[]}
{"reqId":"VaLt798qMfX2VWV88LyZ","level":1,"time":"2026-03-23T21:54:36+00:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"nextcloud_user","app":"no app in context","method":"GET","url":"/ocs/v2.php/cloud/capabilities?format=json","scriptName":"/ocs/v2.php","message":"The user config key files/quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36","version":"32.0.6.1","data":[]}
{"reqId":"scuHTtG871bqkBdaizpS","level":1,"time":"2026-03-23T21:54:38+00:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"nextcloud_user","app":"no app in context","method":"GET","url":"/ocs/v2.php/cloud/capabilities?format=json","scriptName":"/ocs/v2.php","message":"The user config key files/quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36","version":"32.0.6.1","data":[]}
{"reqId":"WjcTtbD736ET74pfNY0m","level":1,"time":"2026-03-23T21:54:38+00:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"nextcloud_user","app":"no app in context","method":"GET","url":"/ocs/v2.php/cloud/capabilities?format=json","scriptName":"/ocs/v2.php","message":"The user config key files/quota is not defined in the config lexicon","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36","version":"32.0.6.1","data":[]}

Start with the protected bookmarks API entry points shown in the report: the lock endpoint and the folder requests using basic authorization, then the saved bearer token. Reproduce the root-folder request followed by the child-folder request on an affected Nextcloud 31/32 installation and compare the authorization handling. Done means bearer-authenticated API requests are routed successfully instead of returning HTTP 405.