[Bug]: Sessions expire and don't obey either session_keepalive or session_lifetime settings.

FalcoGer commented 1 year ago

⚠️ This issue respects the following points: ⚠️

[X] This is a bug, not a question or a configuration/webserver/proxy issue.
[X] This issue is not already reported on Github (I've searched it).
[x] Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
[X] Nextcloud Server is running on 64bit capable CPU, PHP and OS.
[X] I agree to follow Nextcloud's Code of Conduct.

Bug description

I have a folder mounted in my linux OS with my file manager with this address: davs://<username>@<hostname>/nextcloud/remote.php/dav/files/<username>, this works fine. However when I try to put large files onto the cloud, for example a large video, the file operation times out after about 5 minutes.

I have tried putting session_lifetime => 86400 (24h) into the config file, but that didn't do anything.

Steps to reproduce

Mount WebDAV
Make a transfer that takes a long time
Wait for OS throwing an error at you

Expected behavior

Session is kept up while the transfer is going on.

Installation method

Community Manual installation with Archive

Nextcloud Server version

25

Operating system

Debian/Ubuntu

PHP engine version

PHP 7.4

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

[X] Default user-backend (database)
[ ] LDAP/ Active Directory
[ ] SSO - SAML
[ ] Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "version": "25.0.4.1",
        "installed": true,
        "trusted_domains": [
            "localhost",
            "***REMOVED SENSITIVE VALUE***",,
            "***REMOVED SENSITIVE VALUE***",
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "knowledgebaseenabled": true,
        "session_keepalive": true,
        "auto_logout": true,
        "logfile": "\/var\/nextcloud\/nextcloud.log",
        "logfilemode": 416,
        "enable_previews": true,
        "overwrite.cli.url": "https:\/\/falcoger.ddns.net\/nextcloud",
        "htaccess.RewriteBase": "\/nextcloud",
        "theme": "",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [
            "files_clipboard",
            "caniupdate"
        ],
        "maintenance": false,
        "loglevel": 2,
        "updater.release.channel": "stable",
        "remember_login_cookie_lifetime": 1296000,
        "session_lifetime": 86400
    }
}

List of activated Apps

Enabled:
  - activity: 2.17.0
  - announcementcenter: 6.5.1
  - calendar: 4.3.1
  - checksum: 1.2.1
  - circles: 25.0.0
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contacts: 5.2.0
  - contactsinteraction: 1.6.0
  - dashboard: 7.5.0
  - dav: 1.24.0
  - encryption: 2.13.0
  - federatedfilesharing: 1.15.0
  - federation: 1.15.0
  - files: 1.20.1
  - files_archive: 1.1.2
  - files_fulltextsearch: 25.0.0
  - files_mindmap: 0.0.27
  - files_pdfviewer: 2.6.0
  - files_rightclick: 1.4.0
  - files_sharing: 1.17.0
  - files_trashbin: 1.15.0
  - files_versions: 1.18.0
  - fileslibreofficeedit: 1.1.0
  - firstrunwizard: 2.14.0
  - fulltextsearch: 25.0.0
  - integration_github: 1.0.15
  - logreader: 2.10.0
  - lookup_server_connector: 1.13.0
  - mail: 2.2.5
  - nextcloud_announcements: 1.14.0
  - notifications: 2.13.1
  - oauth2: 1.13.0
  - password_policy: 1.15.0
  - passwords: 2023.4.30
  - photos: 2.0.1
  - privacy: 1.9.0
  - provisioning_api: 1.15.0
  - quota_warning: 1.16.0
  - recommendations: 1.4.0
  - registration: 2.1.0
  - related_resources: 1.0.4
  - richdocuments: 7.1.2
  - richdocumentscode_arm64: 22.5.802
  - secrets: 1.4.0
  - serverinfo: 1.15.0
  - settings: 1.7.0
  - sharebymail: 1.15.0
  - spreed: 15.0.5
  - support: 1.8.0
  - survey_client: 1.13.0
  - suspicious_login: 4.3.0
  - systemtags: 1.15.0
  - tasks: 0.14.5
  - text: 3.6.0
  - theming: 2.0.1
  - twofactor_backupcodes: 1.14.0
  - updatenotification: 1.15.0
  - user_status: 1.5.0
  - viewer: 1.9.0
  - weather_status: 1.5.0
  - workflowengine: 2.7.0
Disabled:
  - admin_audit
  - bruteforcesettings: 2.4.0
  - files_external
  - files_markdown: 2.3.6
  - fulltextsearch_elasticsearch: 25.0.0
  - impersonate: 1.12.0
  - music: 1.8.2
  - ocdownloader: 1.9.1
  - polls: 4.1.8
  - twofactor_totp
  - user_ldap

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No response

Additional info

Using caja for mounting on ubuntu mate 22.04.

FalcoGer commented 1 year ago

After logging on in the web browser, the session also expired there. While there was enough time to upload the files, the session should not expire before 24 hours (the session lifetime) is up. What gives? Furthermore the session should be kept alive because session_keepalive is set. So the session should not expire at all until I close the tab in the browser and then 24h pass.

joshtrichards commented 1 year ago

What is your PHP session handling configuration? e.g. See #24316

Your other issue may be related to you're having auto_logout enabled:

Enable or disable the automatic logout after session_lifetime, even if session keepalive is enabled. This will make sure that an inactive browser will be logged out even if requests to the server might extend the session lifetime.

--https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/config_sample_php_parameters.html

FalcoGer commented 1 year ago

after session_lifetime

which is 24 hours. I don't see how automatic logout should log me out after 10 minutes then?

I don't use opcache at all.

joshtrichards commented 1 year ago

Let's back up a moment.

Can you provide your php config?
- https://docs.nextcloud.com/server/latest/admin_manual/issues/general_troubleshooting.html#label-phpinfo
What happens when you upload a similar file via the Web UI?
What is the nearest matching entry in your nextcloud logs during upload timeout events?
What size are these files, specifically, typically?
What makes you think this session related? (It may be, but I'm asking because there are other factors like web server, proxies, and php configs that can impact/limit large file uploads based on both size and request timeouts)

FalcoGer commented 1 year ago

I disabled auto_logout and it seems to have solved the issue. I still don't understand why though.

FalcoGer commented 1 year ago

Can you provide your php config?

/etc/php/8.1/cli/php.ini

[PHP]
engine = On
short_open_tag = Off
precision = 14
output_buffering = 4096
zlib.output_compression = Off
implicit_flush = Off
unserialize_callback_func =
serialize_precision = -1
disable_functions =
disable_classes =
zend.enable_gc = On
zend.exception_ignore_args = On
zend.exception_string_param_max_len = 0
expose_php = On
max_execution_time = 30
max_input_time = 60
memory_limit = -1
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
display_errors = Off
display_startup_errors = Off
log_errors = On
ignore_repeated_errors = Off
ignore_repeated_source = Off
report_memleaks = On
variables_order = "GPCS"
request_order = "GP"
register_argc_argv = Off
auto_globals_jit = On
post_max_size = 8M
auto_prepend_file =
auto_append_file =
default_mimetype = "text/html"
default_charset = "UTF-8"
doc_root =
user_dir =
enable_dl = Off
file_uploads = On
upload_max_filesize = 2M
max_file_uploads = 20
allow_url_fopen = On
allow_url_include = Off
default_socket_timeout = 60

[CLI Server]
cli_server.color = On

[Date]

[filter]

[iconv]

[imap]

[intl]

[sqlite3]

[Pcre]

[Pdo]

[Pdo_mysql]
pdo_mysql.default_socket=

[Phar]

[mail function]
SMTP = localhost
smtp_port = 25
mail.add_x_header = Off

[ODBC]
odbc.allow_persistent = On
odbc.check_persistent = On
odbc.max_persistent = -1
odbc.max_links = -1
odbc.defaultlrl = 4096
odbc.defaultbinmode = 1

[MySQLi]
mysqli.max_persistent = -1
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off

[mysqlnd]
mysqlnd.collect_statistics = On
mysqlnd.collect_memory_statistics = Off

[OCI8]

[PostgreSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0

[bcmath]
bcmath.scale = 0

[browscap]

[Session]
session.save_handler = files
session.use_strict_mode = 0
session.use_cookies = 1
session.use_only_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.cookie_httponly =
session.cookie_samesite =
session.serialize_handler = php
session.gc_probability = 0
session.gc_divisor = 1000
session.gc_maxlifetime = 1440
session.referer_check =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0
session.sid_length = 26
session.trans_sid_tags = "a=href,area=href,frame=src,form="
session.sid_bits_per_character = 5

[Assertion]
zend.assertions = -1

[COM]

[mbstring]

[gd]

[exif]

[Tidy]
tidy.clean_output = Off

[soap]
soap.wsdl_cache_enabled=1
soap.wsdl_cache_dir="/tmp"
soap.wsdl_cache_ttl=86400
soap.wsdl_cache_limit = 5

[sysvshm]

[ldap]
ldap.max_links = -1

[dba]

[opcache]
opcache.interned_strings_buffer=32

[curl]

[openssl]

[ffi]
apc.enable_cli=1

/etc/php/8.1/apache2/php.ini

[PHP]
engine = On
short_open_tag = Off
precision = 14
output_buffering = Off
zlib.output_compression = Off
implicit_flush = Off
unserialize_callback_func =
serialize_precision = -1
disable_functions =
disable_classes =
zend.enable_gc = On
zend.exception_ignore_args = On
zend.exception_string_param_max_len = 0
expose_php = Off
max_execution_time = 30
max_input_time = 60
memory_limit = 512M
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
display_errors = Off
display_startup_errors = Off
log_errors = On
ignore_repeated_errors = Off
ignore_repeated_source = Off
report_memleaks = On
variables_order = "GPCS"
request_order = "GP"
register_argc_argv = Off
auto_globals_jit = On
post_max_size = 8M
auto_prepend_file =
auto_append_file =
default_mimetype = "text/html"
default_charset = "UTF-8"
doc_root =
user_dir =
enable_dl = Off
file_uploads = On
upload_max_filesize = 2M
max_file_uploads = 20
allow_url_fopen = On
allow_url_include = Off
default_socket_timeout = 60

[CLI Server]
cli_server.color = On

[Date]

[filter]

[iconv]

[imap]

[intl]

[sqlite3]

[Pcre]

[Pdo]

[Pdo_mysql]
pdo_mysql.default_socket=

[Phar]

[mail function]
SMTP = localhost
smtp_port = 25
mail.add_x_header = Off

[ODBC]
odbc.allow_persistent = On
odbc.check_persistent = On
odbc.max_persistent = -1
odbc.max_links = -1
odbc.defaultlrl = 4096
odbc.defaultbinmode = 1

[MySQLi]
mysqli.max_persistent = -1
mysqli.allow_persistent = On
mysqli.max_links = -1
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off

[mysqlnd]
mysqlnd.collect_statistics = On
mysqlnd.collect_memory_statistics = Off

[OCI8]

[PostgreSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0

[bcmath]
bcmath.scale = 0

[browscap]

[Session]
session.save_handler = files
session.use_strict_mode = 0
session.use_cookies = 1
session.use_only_cookies = 1
session.name = PHPSESSID
session.auto_start = 0
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.cookie_httponly =
session.cookie_samesite =
session.serialize_handler = php
session.gc_probability = 0
session.gc_divisor = 1000
session.gc_maxlifetime = 1440
session.referer_check =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = 0
session.sid_length = 26
session.trans_sid_tags = "a=href,area=href,frame=src,form="
session.sid_bits_per_character = 5

[Assertion]
zend.assertions = -1

[COM]

[mbstring]

[gd]

[exif]

[Tidy]
tidy.clean_output = Off

[soap]
soap.wsdl_cache_enabled=1
soap.wsdl_cache_dir="/tmp"
soap.wsdl_cache_ttl=86400
soap.wsdl_cache_limit = 5

[sysvshm]

[ldap]
ldap.max_links = -1

[dba]

[opcache]
opcache.interned_strings_buffer=32

[curl]

[openssl]

[ffi]
apc.enable_cli=1

What happens when you upload a similar file via the Web UI?

Also timed out. Couldn't even watch a long movie on nextcloud without getting kicked out of it halfway through.

What size are these files, specifically, typically?

At the time it was a 5.5GiB video file.

What makes you think this session related? (It may be, but I'm asking because there are other factors like web server, proxies, and php configs that can impact/limit large file uploads based on both size and request timeouts)

Because I also get kicked out of the session without uploading anything and just letting it sit there without clicking links.

joshtrichards commented 1 year ago

Thanks.

I thought you were using PHP 7.4 (that's what your original report indicated)? Your configs are from 8.1. It's possible to have multiple versions installed - are you certain you don't?

If you go to Admin->System (aka: https://server/settings/admin/serverinfo in the Web UI what version shows under PHP?

FalcoGer commented 1 year ago

Version: 8.1.2 sorry about that.

skjnldsv commented 1 year ago

session.cookie_lifetime: int

session.cookie_lifetime specifies the lifetime of the cookie in seconds which is sent to the browser. The value 0 means "until the browser is closed." Defaults to 0. See also session_get_cookie_params() and session_set_cookie_params().

This might be your issue?

joshtrichards commented 5 months ago

We haven't had any other reports of this since your report.

I'm afraid the evidence suggests this is some sort of environment issue.

There are many Debian and Ubuntu based deployments throughout the community. I suggest posting at the Nextcloud Help Forum (https://help.nextcloud.com) and seeing if you can get some feedback (that hopefully turns up whatever is causing this for you).

Sorry we couldn't be of more help.

nextcloud / server