Having to log in twice

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I am running my own server. I am usually logged in. Since a long time, I am getting auto locked out. Should be always after about a week I think, which I do not like, but for security reasons it hasn't bothered so far. But what bothered me is, I need to login twice. I also have 2FA enabled and thought it might be because of that and when I visit:

https://mydomain.com/apps/calendar/ -> redirects to: https://mydomain.com/login?redirect_url=/apps/calendar/

So I thought it was a problem with the '?redirect_url=' part, but can't reproduce this in incognito.

I login, have to login again, 2FA code, and then being logged in. But when I do this in a incognito tab, I only have to login once plus the 2FA code. This must mean, I seem not to be fully auto logged out (?), because I only have a page refresh the first time which maybe clears my login cookies or something in that direction, so it recognizes the second login attempt?

Steps to reproduce

1. Having TOTP 2FA enabled
2. Being not logged in any more after some days due to auto logout or so
3. Try to login
4. Need to login again
5. Enter 2FA code
6. Being logged in

Expected behavior

Only having to login once and enter the 2FA code.

Installation method

Manual installation

Operating system

Debian/Ubuntu

PHP engine version

PHP 7.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

No response

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "next.mal-noh.de",
            "next.limited-dev.de"
        ],
        "dbtype": "mysql",
        "version": "23.0.4.1",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "updatechecker": true,
        "updater.release.channel": "stable",
        "maintenance": false,
        "theme": "",
        "loglevel": 0,
        "default_language": "de",
        "default_locale": "de",
        "default_phone_region": "DE",
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "tls",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 60",
        "overwrite.cli.url": "https:\/\/next.mal-noh.de"
    }
}

List of activated Apps

Enabled:
  - accessibility: 1.9.0
  - activity: 2.15.0
  - breezedark: 23.2.1
  - bruteforcesettings: 2.4.0
  - calendar: 3.2.2
  - camerarawpreviews: 0.7.15
  - circles: 23.1.1
  - cloud_federation_api: 1.6.0
  - comments: 1.13.0
  - contacts: 4.1.0
  - contactsinteraction: 1.4.0
  - cookbook: 0.9.11
  - dashboard: 7.3.0
  - dav: 1.21.0
  - external: 3.10.2
  - federatedfilesharing: 1.13.0
  - federation: 1.13.0
  - files: 1.18.0
  - files_pdfviewer: 2.4.0
  - files_rightclick: 1.2.0
  - files_sharing: 1.15.0
  - files_trashbin: 1.13.0
  - files_versions: 1.16.0
  - files_videoplayer: 1.12.0
  - integration_github: 1.0.2
  - logreader: 2.8.0
  - lookup_server_connector: 1.11.0
  - mail: 1.12.0
  - notes: 4.3.1
  - notifications: 2.11.1
  - oauth2: 1.11.0
  - onlyoffice: 7.3.2
  - password_policy: 1.13.0
  - passwords: 2022.4.10
  - photos: 1.5.0
  - privacy: 1.7.0
  - provisioning_api: 1.13.0
  - serverinfo: 1.13.0
  - settings: 1.5.0
  - sharebymail: 1.13.0
  - spreed: 13.0.5
  - support: 1.6.0
  - systemtags: 1.13.0
  - tasks: 0.14.4
  - text: 3.4.1
  - theming: 1.14.0
  - twofactor_admin: 3.2.0
  - twofactor_backupcodes: 1.12.0
  - twofactor_totp: 6.3.0
  - updatenotification: 1.13.0
  - user_status: 1.3.1
  - viewer: 1.7.0
  - weather_status: 1.3.0
  - workflowengine: 2.5.0
Disabled:
  - admin_audit
  - apporder: 0.15.0
  - encryption
  - files_external
  - firstrunwizard: 2.10.0
  - music: 1.5.1
  - nextcloud_announcements: 1.10.0
  - recommendations: 1.0.0
  - survey_client: 1.9.0
  - user_ldap

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Getting "There was an error creating your issue: body is too long (maximum is 65536 characters). " when I paste it in here. If you should really need the file I can upload it in a comment.

Additional info

No response

Start by reproducing the login flow from /apps/calendar/ after the session has expired, comparing a normal browser with an incognito tab and checking the available Nextcloud logs. Trace the redirect to /login?redirect_url=/apps/calendar/ and the TOTP step; done means an expired session requires one login and one 2FA code without repeating the login.