From 0a14c50f4588a2b435a560bbbc098dc664c29024 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Thu, 20 Aug 2026 10:28:08 +0200 Subject: [PATCH 1/3] feat: Add more debug output when checkTokenCredentials fails Signed-off-by: Carl Schwan --- lib/private/User/Session.php | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php index 107f63fe81628..5e2acc54ce104 100644 --- a/lib/private/User/Session.php +++ b/lib/private/User/Session.php @@ -702,7 +702,7 @@ private function getPassword($password) { * @param string $token * @return boolean */ - private function checkTokenCredentials(IToken $dbToken, $token) { + private function checkTokenCredentials(IToken $dbToken, $token, array &$reason) { // Check whether login credentials are still valid and the user was not disabled // This check is performed each 5 minutes $lastCheck = $dbToken->getLastCheck() ? : 0; @@ -715,12 +715,19 @@ private function checkTokenCredentials(IToken $dbToken, $token) { try { $pwd = $this->tokenProvider->getPassword($dbToken, $token); } catch (InvalidTokenException $ex) { + $reason = [ + 'exception' => $ex, + ]; + // An invalid token password was used -> log user out return false; } catch (PasswordlessTokenException $ex) { // Token has no password - if (!is_null($this->activeUser) && !$this->activeUser->isEnabled()) { + $reason = [ + 'exception' => $ex, + 'message' => 'Paswordless token exception with no active or disabled user', + ]; $this->tokenProvider->invalidateToken($token); return false; } @@ -731,12 +738,18 @@ private function checkTokenCredentials(IToken $dbToken, $token) { // Invalidate token if the user is no longer active if (!is_null($this->activeUser) && !$this->activeUser->isEnabled()) { $this->tokenProvider->invalidateToken($token); + $reason = [ + 'message' => 'Invalidate token as the user is no longer active', + ]; return false; } // If the token password is no longer valid mark it as such if ($this->manager->checkPassword($dbToken->getLoginName(), $pwd) === false) { $this->tokenProvider->markPasswordInvalid($dbToken, $token); + $reason = [ + 'message' => 'The token password is no longer valid', + ]; // User is logged out return false; } @@ -774,11 +787,12 @@ private function validateToken($token, $user = null) { return false; } - if (!$this->checkTokenCredentials($dbToken, $token)) { - $this->logger->warning('Session token credentials are invalid', [ + $reason = []; + if (!$this->checkTokenCredentials($dbToken, $token, $reason)) { + $this->logger->warning('Session token credentials are invalid', array_merge($reason, [ 'app' => 'core', 'user' => $user, - ]); + ])); return false; } From 71847ffd2b7e09d8973f0352d9f7415a7da2405a Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Thu, 20 Aug 2026 10:44:32 +0200 Subject: [PATCH 2/3] fix: Add backtrace when login fails Signed-off-by: Carl Schwan --- lib/private/User/Session.php | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php index 5e2acc54ce104..6d75e854fe17e 100644 --- a/lib/private/User/Session.php +++ b/lib/private/User/Session.php @@ -470,7 +470,7 @@ public function logClientIn($user, } private function handleLoginFailed(IThrottler $throttler, int $currentDelay, string $remoteAddress, string $user, ?string $password) { - $this->logger->warning("Login failed: '" . $user . "' (Remote IP: '" . $remoteAddress . "')", ['app' => 'core']); + $this->logger->warning("Login failed: '" . $user . "' (Remote IP: '" . $remoteAddress . "')", ['app' => 'core', 'exception' => new \Exception()]); $throttler->registerAttempt('login', $remoteAddress, ['user' => $user]); $this->dispatcher->dispatchTyped(new LoginFailed($user, $password)); @@ -767,11 +767,9 @@ private function checkTokenCredentials(IToken $dbToken, $token, array &$reason) * * Invalidates the token if checks fail * - * @param string $token - * @param string $user login name - * @return boolean + * @param ?string $user The login name */ - private function validateToken($token, $user = null) { + private function validateToken(string $token, ?string $user = null): bool { try { $dbToken = $this->tokenProvider->getToken($token); } catch (InvalidTokenException $ex) { From e320b06017b73c02f47ac87e0a7e64df9b402fc6 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Thu, 20 Aug 2026 11:40:43 +0200 Subject: [PATCH 3/3] chore: Add more debug output Signed-off-by: Carl Schwan --- lib/private/Authentication/Token/PublicKeyToken.php | 6 +++++- lib/private/User/Session.php | 12 +++++++----- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/lib/private/Authentication/Token/PublicKeyToken.php b/lib/private/Authentication/Token/PublicKeyToken.php index 3164a120aeadb..8fe11135f4335 100644 --- a/lib/private/Authentication/Token/PublicKeyToken.php +++ b/lib/private/Authentication/Token/PublicKeyToken.php @@ -128,7 +128,11 @@ public function getLoginName(): string { */ #[\Override] public function getPassword(): ?string { - return parent::getPassword(); + $password = parent::getPassword(); + if ($password === '') { + return null; + } + return $password; } #[\Override] diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php index 6d75e854fe17e..4458fb0543674 100644 --- a/lib/private/User/Session.php +++ b/lib/private/User/Session.php @@ -726,7 +726,7 @@ private function checkTokenCredentials(IToken $dbToken, $token, array &$reason) if (!is_null($this->activeUser) && !$this->activeUser->isEnabled()) { $reason = [ 'exception' => $ex, - 'message' => 'Paswordless token exception with no active or disabled user', + 'additional_message' => 'Passwordless token exception with no active or disabled user', ]; $this->tokenProvider->invalidateToken($token); return false; @@ -739,7 +739,7 @@ private function checkTokenCredentials(IToken $dbToken, $token, array &$reason) if (!is_null($this->activeUser) && !$this->activeUser->isEnabled()) { $this->tokenProvider->invalidateToken($token); $reason = [ - 'message' => 'Invalidate token as the user is no longer active', + 'additional_message' => 'Invalidate token as the user is no longer active', ]; return false; } @@ -748,7 +748,7 @@ private function checkTokenCredentials(IToken $dbToken, $token, array &$reason) if ($this->manager->checkPassword($dbToken->getLoginName(), $pwd) === false) { $this->tokenProvider->markPasswordInvalid($dbToken, $token); $reason = [ - 'message' => 'The token password is no longer valid', + 'additional_message' => 'The token password is no longer valid and is ' . (empty($pwd) ? 'empty' : 'not empty'), ]; // User is logged out return false; @@ -787,10 +787,12 @@ private function validateToken(string $token, ?string $user = null): bool { $reason = []; if (!$this->checkTokenCredentials($dbToken, $token, $reason)) { - $this->logger->warning('Session token credentials are invalid', array_merge($reason, [ + $this->logger->warning('Session token credentials are invalid', [ 'app' => 'core', 'user' => $user, - ])); + 'token name' => $dbToken->getName(), + ...$reason, + ]); return false; }