-
-
Notifications
You must be signed in to change notification settings - Fork 4.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Bug]: Two useless authtoken database queries for every anonymous request #42589
Closed
4 of 8 tasks
Labels
Comments
2 tasks
Could this fix it? server/lib/private/User/Session.php Lines 861 to 866 in 7502c19
|
Yes, something like that should do the trick |
Should i PR it? :) |
Yes please :) Two suggestions:
|
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bug description
Reading query logs I noticed
for every anonymous request.
The problem is that
\OC\User\Session::tryTokenLogin
tries to find a token for the current PHP session.\OC\Authentication\Token\PublicKeyTokenProvider::getToken
does up to two lookups when the instance has an instance secret set. There will never be a hit. The only exception would be a hash collision of the new session ID and a previous one.The solution would be to check if the request had sent a cookie with the instance id as name. Those are used for the PHP session. If there is no cookie, this is a new session, and there won't be a token.
Steps to reproduce
curl https://localhost/login
Expected behavior
Installation method
None
Nextcloud Server version
26
Operating system
None
PHP engine version
None
Web server
None
Database engine version
None
Is this bug present after an update or on a fresh install?
None
Are you using the Nextcloud Server Encryption module?
None
What user-backends are you using?
Configuration report
No response
List of activated Apps
No response
Nextcloud Signing status
No response
Nextcloud Logs
No response
Additional info
No response
The text was updated successfully, but these errors were encountered: