[Bug]: Large background images break app login on iOS

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When I set a custom background to an image that is 7,3MB in my case the login flow fails on the iOS app with:

InvalidTokenException
Token does not exist: token does not exist

When I set a smaller image, for example the default images, everything is fine

Deployment: https://github.com/docker-library/docs/blob/master/nextcloud/README.md

Proxy: Traefik 3.4.4

Steps to reproduce

1. Upload a large image: I used a 7.3 MB image from unsplash (jpg)
2. Set as background in settings of the user
3. Login to iOS app: the login window appears a second time and after that: Zustandstoken fehlt
4. remove background image or set a small image
5. login to IOS app: works fine

Expected behavior

a. Error message (image too large) when setting one that is too large for iOS Webview to handle it.
b. Do not use background image in login flow

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "token_auth_enforced": false,
        "auth.bruteforce.protection.enabled": true,
        "session_lifetime": 86400,
        "session_keepalive": true,
        "maintenance_window_start": 1,
        "default_phone_region": "DE",
        "htaccess.RewriteBase": "\/",
        "skeletondirectory": "",
        "templatedirectory": "",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "upgrade.disable-web": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "<my domain>"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "31.0.7.1",
        "overwrite.cli.url": "https:\/\/<my domain>",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR",
            "HTTP_FORWARDED"
        ],
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "maintenance": false,
        "app_install_overwrite": [],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        }
    }
}

List of activated Apps

Enabled:
  - activity: 4.0.0
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - calendar: 5.3.6
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.2.0
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - groupfolders: 19.1.2
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - mail: 5.1.9
  - nextcloud_announcements: 3.0.0
  - notes: 4.12.2
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - photos: 4.0.0
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - richdocuments: 8.7.2
  - richdocumentscode_arm64: 25.4.202
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - spreed: 21.1.2
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - admin_audit: 1.21.0
  - encryption: 2.19.0
  - files_external: 1.23.0
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - user_ldap: 1.22.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"8gVBMcvpslIrUOFkzwWU","level":3,"time":"2025-07-22T13:07:11+00:00","remoteAddr":"192.168.7.112","user":"--","app":"core","method":"GET","url":"/apps/theming/theme/light-highcontrast.css?plain=1&v=1746d34c","message":"Renewing session token failed: Token does not exist: token does not exist","userAgent":"Mozilla/5.0 (iOS) Nextcloud-iOS/7.0.4","version":"31.0.7.1","exception":{"Exception":"OC\\Authentication\\Exceptions\\InvalidTokenException","Message":"Token does not exist: token does not exist","Code":0,"Trace":[{"file":"/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":232,"function":"getToken","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/public/AppFramework/Db/TTransactional.php","line":45,"function":"OC\\Authentication\\Token\\{closure}","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":231,"function":"atomic","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":[{"__class__":"Closure"},{"__class__":"OC\\DB\\ConnectionAdapter"}]},{"file":"/var/www/html/lib/private/Authentication/Token/Manager.php","line":155,"function":"renewSessionToken","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***","3998891667428dc91c446f169e768580"]},{"file":"/var/www/html/lib/private/User/Session.php","line":883,"function":"renewSessionToken","class":"OC\\Authentication\\Token\\Manager","type":"->","args":["*** sensitive parameters replaced ***","3998891667428dc91c446f169e768580"]},{"file":"/var/www/html/lib/base.php","line":1122,"function":"loginWithCookie","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/base.php","line":1029,"function":"handleLogin","class":"OC","type":"::","args":[{"__class__":"OC\\AppFramework\\Http\\Request"}]},{"file":"/var/www/html/index.php","line":24,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php","Line":165,"Previous":{"Exception":"OCP\\AppFramework\\Db\\DoesNotExistException","Message":"token does not exist","Code":0,"Trace":[{"file":"/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":157,"function":"getToken","class":"OC\\Authentication\\Token\\PublicKeyTokenMapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":232,"function":"getToken","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/public/AppFramework/Db/TTransactional.php","line":45,"function":"OC\\Authentication\\Token\\{closure}","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":231,"function":"atomic","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":[{"__class__":"Closure"},{"__class__":"OC\\DB\\ConnectionAdapter"}]},{"file":"/var/www/html/lib/private/Authentication/Token/Manager.php","line":155,"function":"renewSessionToken","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***","3998891667428dc91c446f169e768580"]},{"file":"/var/www/html/lib/private/User/Session.php","line":883,"function":"renewSessionToken","class":"OC\\Authentication\\Token\\Manager","type":"->","args":["*** sensitive parameters replaced ***","3998891667428dc91c446f169e768580"]},{"file":"/var/www/html/lib/base.php","line":1122,"function":"loginWithCookie","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/base.php","line":1029,"function":"handleLogin","class":"OC","type":"::","args":[{"__class__":"OC\\AppFramework\\Http\\Request"}]},{"file":"/var/www/html/index.php","line":24,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/lib/private/Authentication/Token/PublicKeyTokenMapper.php","Line":81},"message":"Renewing session token failed: Token does not exist: token does not exist","user":"mattias","exception":[],"CustomMessage":"Renewing session token failed: Token does not exist: token does not exist"},"id":"687f8f2782ed2"}

Additional info

iOS App: 7.0.4
iOS: 18.5

traefik labels part of docker-compose.yml (nextcloud):

    labels:
      - "traefik.enable=true"
      
      # Services
      - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
      
      # Main Nextcloud Router
      - "traefik.http.routers.nextcloud.rule=Host(`<my domain>`)"
      - "traefik.http.routers.nextcloud.entrypoints=websecure"
      - "traefik.http.routers.nextcloud.tls.certresolver=buypassresolver"
      - "traefik.http.routers.nextcloud.service=nextcloud"
      - "traefik.http.routers.nextcloud.middlewares=nextcloud-headers"
      - "traefik.http.routers.nextcloud.priority=100"
      
      # .well-known CalDAV (ohne Slash)
      - "traefik.http.routers.wellknown-caldav.rule=Host(`<my domain>`) && Path(`/.well-known/caldav`)"
      - "traefik.http.routers.wellknown-caldav.entrypoints=websecure"
      - "traefik.http.routers.wellknown-caldav.tls.certresolver=buypassresolver"
      - "traefik.http.routers.wellknown-caldav.middlewares=wellknown-redirect"
      - "traefik.http.routers.wellknown-caldav.service=api@internal"
      - "traefik.http.routers.wellknown-caldav.priority=1000"
     
      # .well-known CalDAV (mit Slash)
      - "traefik.http.routers.wellknown-caldav-slash.rule=Host(`<my domain>`) && Path(`/.well-known/caldav/`)"
      - "traefik.http.routers.wellknown-caldav-slash.entrypoints=websecure"
      - "traefik.http.routers.wellknown-caldav-slash.tls.certresolver=buypassresolver"
      - "traefik.http.routers.wellknown-caldav-slash.middlewares=wellknown-redirect"
      - "traefik.http.routers.wellknown-caldav-slash.service=api@internal"
      - "traefik.http.routers.wellknown-caldav-slash.priority=1000"
     
      # .well-known CardDAV (ohne Slash)
      - "traefik.http.routers.wellknown-carddav.rule=Host(`<my domain>`) && Path(`/.well-known/carddav`)"
      - "traefik.http.routers.wellknown-carddav.entrypoints=websecure"
      - "traefik.http.routers.wellknown-carddav.tls.certresolver=buypassresolver"
      - "traefik.http.routers.wellknown-carddav.middlewares=wellknown-redirect"
      - "traefik.http.routers.wellknown-carddav.service=api@internal"
      - "traefik.http.routers.wellknown-carddav.priority=1000"
     
      # .well-known CardDAV (mit Slash)
      - "traefik.http.routers.wellknown-carddav-slash.rule=Host(`<my domain>`) && Path(`/.well-known/carddav/`)"
      - "traefik.http.routers.wellknown-carddav-slash.entrypoints=websecure"
      - "traefik.http.routers.wellknown-carddav-slash.tls.certresolver=buypassresolver"
      - "traefik.http.routers.wellknown-carddav-slash.middlewares=wellknown-redirect"
      - "traefik.http.routers.wellknown-carddav-slash.service=api@internal"
      - "traefik.http.routers.wellknown-carddav-slash.priority=1000"
     
      # Redirect Middleware
      - "traefik.http.middlewares.wellknown-redirect.redirectregex.regex=.*"
      - "traefik.http.middlewares.wellknown-redirect.redirectregex.replacement=https://<my domain>/remote.php/dav/"
      - "traefik.http.middlewares.wellknown-redirect.redirectregex.permanent=true"
     
      # Headers Middleware
      - "traefik.http.middlewares.nextcloud-headers.headers.hostsproxyheaders=X-Forwarded-Host"
      - "traefik.http.middlewares.nextcloud-headers.headers.referrerpolicy=same-origin"
      - "traefik.http.middlewares.nextcloud-headers.headers.stsseconds=15552000"
      - "traefik.http.middlewares.nextcloud-headers.headers.stsincludesubdomains=true"
      - "traefik.http.middlewares.nextcloud-headers.headers.stspreload=true"
      - "traefik.http.middlewares.nextcloud-headers.headers.forcestsheader=true"

Reproduce the login failure in the iOS app with a 7.3 MB custom background, then inspect the login flow around the /apps/theming/theme/light-highcontrast.css request and the reported token-renewal stack trace. Compare it with a smaller background image and confirm that the completed change prevents the large image from breaking login or provides the requested size handling.