Tried to log in "user" but could not verify token

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

As soon as I open Nextcloud in a new tab, I get redirected to login page and have to login again. Then always the first login fails/nothing happens, so I have to login twice. I am seeing lots of "Tried to log in "user" but could not verify token" errors in log.

It is only happening on Safari (macOS, iOS, iPadOS), tried several versions, also did a clean install of Nextcloud 26 and still the same. Also tried with another user account on a different Mac.

At first I thought it could be related to #33919, but it doesn't seem to be the case. I really spent many hours in trying to get this fixed, but I have no clue, why it is not working.

Steps to reproduce

1. Login to Nextcloud in Safari
2. Open another tab and open Nextcloud (alternatively close browser and open it again)
3. You will be redirected to login page and the message "Tried to log in "user" but could not verify token" is in log file.

Expected behavior

The user should still be logged in and not be redirected to login page.

Installation method

Community Manual installation with Archive

Nextcloud Server version

26

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "26.0.0.11",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "mail_smtpsecure": "tls",
        "mail_sendmailmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "csrf.disabled": true,
        "integrity.check.disabled": true,
        "logfile": "\/var\/www\/cloud\/data\/nextcloud.log",
        "loglevel": 4,
        "enable_previews": true,
        "remember_login_cookie_lifetime": 31536000,
        "session_lifetime": 31536000,
        "session_relaxed_expiry": true,
        "session_keepalive": true,
        "simpleSignUpLink.shown": false,
        "htaccess.IgnoreFrontController": true,
        "default_phone_region": "DE",
        "default_language": "de",
        "force_language": "de",
        "theme": "***REMOVED SENSITIVE VALUE***",
        "defaultapp": "files",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "updater.release.channel": "stable"
    }
}

List of activated Apps

Enabled:
  - cloud_federation_api: 1.9.0
  - comments: 1.16.0
  - dav: 1.25.0
  - federatedfilesharing: 1.16.0
  - files: 1.21.1
  - files_pdfviewer: 2.7.0
  - files_rightclick: 1.5.0
  - files_sharing: 1.18.0
  - files_versions: 1.19.1
  - logreader: 2.11.0
  - lookup_server_connector: 1.14.0
  - notes: 4.7.2
  - notifications: 2.14.0
  - oauth2: 1.14.0
  - password_policy: 1.16.0
  - provisioning_api: 1.16.0
  - related_resources: 1.1.0-alpha1
  - settings: 1.8.0
  - sharebymail: 1.16.0
  - systemtags: 1.16.0
  - theming: 2.1.1
  - theming_customcss: 1.13.0
  - twofactor_backupcodes: 1.15.0
  - updatenotification: 1.16.0
  - viewer: 1.10.0
  - workflowengine: 2.8.0
Disabled:
  - activity: 2.18.0 (installed 2.14.3)
  - admin_audit: 1.16.0
  - bruteforcesettings: 2.6.0 (installed 2.3.0)
  - circles: 26.0.0 (installed 26.0.0)
  - contactsinteraction: 1.7.0 (installed 1.7.0)
  - dashboard: 7.6.0 (installed 7.1.0)
  - encryption: 2.14.0
  - extract: 1.3.5 (installed 1.3.5)
  - federation: 1.16.0 (installed 1.16.0)
  - files_external: 1.18.0
  - files_texteditor: 2.15.0 (installed 2.15.0)
  - files_trashbin: 1.16.0 (installed 1.11.0)
  - firstrunwizard: 2.15.0 (installed 2.15.0)
  - nextcloud_announcements: 1.15.0 (installed 1.15.0)
  - photos: 2.2.0 (installed 1.3.0)
  - privacy: 1.10.0 (installed 1.10.0)
  - recommendations: 1.5.0 (installed 1.0.0)
  - serverinfo: 1.16.0 (installed 1.12.0)
  - support: 1.9.0 (installed 1.9.0)
  - survey_client: 1.14.0 (installed 1.9.0)
  - suspicious_login: 4.4.0
  - text: 3.7.2 (installed 3.3.0)
  - twofactor_totp: 8.0.0-alpha.0
  - user_ldap: 1.16.0
  - user_status: 1.6.0 (installed 1.1.1)
  - weather_status: 1.6.0 (installed 1.1.0)

Nextcloud Signing status

No response

Nextcloud Logs

{"reqId":"***REMOVED SENSITIVE VALUE***","level":1,"time":"2023-03-30T11:50:23+00:00","remoteAddr":"***REMOVED SENSITIVE VALUE***","user":"--","app":"core","method":"GET","url":"/login","message":"Tried to log in user but could not verify token","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.4 Safari/605.1.15","version":"26.0.0.11","data":{"app":"core"}}

Additional info

No response

Start by reproducing the Safari login flow described in the issue, including opening a second tab, and inspect the /login request alongside the reported “could not verify token” log entry. Trace the token verification path and compare Safari behavior across the listed platforms. Done means an affected Safari session remains logged in and the repeated verification error no longer occurs.