[Bug]: CSRF Check failed, again

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

This is a reopening of a discussion that started in a closed issue https://github.com/nextcloud/server/issues/40626#issuecomment-3349356861
The symptoms are similar but the cause seems to be different.

I regularly get a CSRF error, when navigating or uploading a file via the web application. The easiest way to reproduce it for me is by navigating in the files app:

After about 5 to 10 clicks on folders, I end up getting a "Unexpected error: invalid response 401, [try again]"
When I look at the network console, I see that indeed the PROPFIND responsed with a 401 with the same sabre response as @michnovka above.
However, when I hit "try again", it usually works. But in the console the exact same request is made (I checked all the headers, they are all the same, and the request body too), with the same csrf token. It’s just successful the second time.

This seems to exclude a front-only issue to me.
In case it helps, between the two calls (the failing one and the successful one) there is always a GET /apps/files/ executed (it’s done automatically just after the 401 is received). Maybe that’s what "unlocks" the situation?

See the few comments starting at the link above for more feedbacks related to the issue.

Steps to reproduce

Not deterministic to reproduce, but just navigating on the web app is sufficient.

The issue started to occur after a migration from apache/httpd to nginx (nothing else changed). I have other nginx similar installs which work "just fine", without being able to spot a relevant difference between them

Expected behavior

Expecting to be able to navigate the web application and upload files without any error

Nextcloud Server version

32

Operating system

Other

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

Start by reproducing navigation in the web application's Files app and inspect the failing PROPFIND request, its 401 response, and the automatic GET /apps/files/ between retries. Compare the identical request headers, body, and CSRF token across both attempts; done means folder navigation and uploads no longer produce intermittent CSRF or 401 errors.