[Bug]: Occasional infinite loop in WebUI hammers notification API

[NiklausHofer]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Ever since upgrading from Nextcloud 29.X to 30.0.5 (and 30.0.6 subsequently), we are seeing extreme load on some instances.

Looking into this, we are seeing hundreds of requests to the notifications API, like so:

<IP> - - [13/Mar/2025:09:53:44 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"

These requests were not there before. It's hundreds of requests per second. Looking at the request headers, we can see that they are coming from only one or two users at a time.

This has led us to suspect that there is a bug in the WebUI that has the web client hammer the API. It would appear to only happen very occasionally - the affected instances have hundreds of users and yet few of them are causing the problem.

We have only ever seen these requests coming from Chrome on Mac OS.

Steps to reproduce

1. Upgrade Nextcloud to 30.0.5 / 30.0.6
2. Have many Mac OS users with Chrome

Unfortunately, we have not been able to reproduce the bug. Plus, reaching an affected user in time to inspect their browser's web console has proven challenging to say the least.

Expected behavior

WebUI is supposed to only access the API end point ever so often.

Nextcloud Server version

30

Operating system

RHEL/CentOS

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "30.0.6.2",
        "overwrite.cli.url": "https:\/\/***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": 3306,
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "apps_paths": [
            {
                "url": "\/apps",
                "writable": false,
                "path": "\/var\/www\/***REMOVED SENSITIVE VALUE***\/app-001\/htdocs\/apps"
            },
            {
                "url": "\/apps-custom",
                "writable": true,
                "path": "\/var\/www\/***REMOVED SENSITIVE VALUE***\/app-001\/htdocs\/apps-custom"
            }
        ],
        "appstoreurl": "https:\/\/***REMOVED SENSITIVE VALUE***/30\/",
        "blacklisted_files": [
            ".htaccess",
            ".DS_Store",
            "._.DS_Store"
        ],
        "default_language": "de",
        "default_locale": "de_CH",
        "default_phone_region": "CH",
        "enable_previews": false,
        "knowledgebaseenabled": false,
        "loglevel": 2,
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": true,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": 587,
        "mail_smtpsecure": "tls",
        "maintenance_window_start": "5",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "overwriteprotocol": "https",
        "overwritewebroot": "\/",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "skeletondirectory": "\/var\/www\/***REMOVED SENSITIVE VALUE***\/app-001\/data\/nextcloud_user_skeleton",
        "trashbin_retention_obligation": "90,91",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "daily",
        "updater.server.url": "***REMOVED SENSITIVE VALUE***",
        "versions_retention_obligation": "auto",
        "maintenance": false
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - app_api: 4.0.6
  - audioplayer: 3.4.1
  - bruteforcesettings: 3.0.0
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.0.3
  - contactsinteraction: 1.11.0
  - dav: 1.31.1
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_accesscontrol: 1.20.1
  - files_downloadlimit: 3.0.0
  - files_linkeditor: 1.1.21
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - groupfolders: 18.1.1
  - impersonate: 1.17.1
  - login_notes: 1.6.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - onlyoffice: 9.7.0
  - password_policy: 2.0.0
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - quota_warning: 1.21.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - terms_of_service: 4.3.0
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_totp: 12.0.0-dev
  - twofactor_webauthn: 2.1.0
  - updatenotification: 1.20.0
  - viewer: 3.0.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - dashboard: 7.10.0 (installed 7.9.0)
  - encryption: 2.18.0
  - files_external: 1.22.0
  - firstrunwizard: 3.0.0 (installed 2.18.0)
  - nextcloud_announcements: 2.0.0 (installed 1.18.0)
  - photos: 3.0.2 (installed 2.5.0)
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - user_ldap: 1.21.0
  - user_status: 1.10.0 (installed 1.9.0)
  - weather_status: 1.10.0 (installed 1.9.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:21 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"
**.***.**.*** - - [13/Mar/2025:10:07:22 +0100] "GET /ocs/v2.php/apps/notifications/api/v2/notifications HTTP/2.0" 412 31 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"

Additional info

No response

[Antreesy]

Can you check for related errors in data/nextcloud.log file on your instance?
Provided access logs from web-server reflect spamming with requests, but returned status code 412 might indicate on something else

[NiklausHofer]

Can you check for related errors in data/nextcloud.log file on your instance?
Provided access logs from web-server reflect spamming with requests, but returned status code 412 might indicate on something else

Really should have thought of that myself :/

Setting the log level to debug, the Nextcloud log is indeed now revealing more details about the issue:

{"reqId":"**********","level":0,"time":"2025-03-14T08:30:29+00:00","remoteAddr":"***.***.***.***","user":"*******.****","app":"no app in context","method":"GET","url":"/ocs/v2.php/apps/notifications/api/v2/notifications","message":"CSRF check failed","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","version":"30.0.6.2","exception":{"Exception":"OC\\AppFramework\\Middleware\\Security\\Exceptions\\CrossSiteRequestForgeryException","Message":"CSRF check failed","Code":412,"Trace":[{"file":"/var/www/****/app-001/htdocs/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php","line":73,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\Security\\SecurityMiddleware","type":"->"},{"file":"/var/www/****/app-001/htdocs/lib/private/AppFramework/Http/Dispatcher.php","line":106,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\MiddlewareDispatcher","type":"->"},{"file":"/var/www/****/app-001/htdocs/lib/private/AppFramework/App.php","line":161,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/****/app-001/htdocs/lib/private/Route/Router.php","line":302,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/****/app-001/htdocs/ocs/v1.php","line":43,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/****/app-001/htdocs/ocs/v2.php","line":7,"args":["/var/www/****/app-001/htdocs/ocs/v1.php"],"function":"require_once"}],"File":"/var/www/****/app-001/htdocs/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php","Line":184,"message":"CSRF check failed","exception":{},"CustomMessage":"CSRF check failed"}}

On instances with SAML plugin, there appears a different message however:

{"reqId":"***********","level":0,"time":"2025-03-14T08:24:34+00:00","remoteAddr":"***.***.***.**","user":"****.*****@********.**","app":"user_saml","method":"GET","url":"/ocs/v2.php/apps/notifications/api/v2/notifications","message":"/appinfo/app.php is deprecated, use \\OCP\\AppFramework\\Bootstrap\\IBootstrap on the application class instead.","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"30.0.5.1","data":{"app":"user_saml"}}

[NiklausHofer]

Googling this new error, I'm pretty sure this is a known issue: nextcloud/server#40626