[Bug]: Public share link fails with "Strict Cookie has not been found in request" and 412 Precondition Failed when clicking, but works when copy-pasting

[TomKamin1]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Hi,
I'm running a Nextcloud instance and encountering a strange behavior when using public share links.

When I click on a share link (e.g., from an email or messenger), I get an error:
{"error":"Strict Cookie has not been found in request"}

Additionally, the browser console shows a failed request:

GET https://cloud.mydomain.eu/public.php/dav/files/<file_id>/?accept=zip  
412 (Precondition Failed)

However, if I copy and paste the same URL manually into the browser's address bar, everything works fine — no errors.

It looks like the problem is a combination of:

• Cookies not being sent due to SameSite policies (Strict or Lax).
• WebDAV requests (like /public.php/dav/) failing when session/auth cookies are missing.

overwrite.cli.url and overwriteprotocol are properly set in config.php.

Steps to reproduce

1. Share a file/folder via public link.
2. Send the link via email or chat.
3. Click the link (don't paste manually).
4. Observe the cookie error and 412 precondition failure.

Expected behavior

Public shares should work reliably when clicked without requiring users to manually paste links.

Notes:

This appears to be a cookie/session handling issue, combined with WebDAV precondition checks.

Browser: [browser + version]

No major proxy misconfiguration detected.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

None

Web server

None

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[socram70]

I can confirm this with the following setup: creating a file link (Thunderbird filelink in this case). It creates a link like https://domain/index.php/s/SHARE-ID/download. When clicking in Firefox or Chrome, this works (even in a private window). When forwarding the link to my Chrome browser on my mobile, this doesn't work and gives me the same error message. Reloading doesn't help here (but copy/pasting the link will start the download).

I noticed that the parameter /?accept=zip is automatically added to the link. When I remove this (and also when I remove "download" from the link), the download works also fine with a click. My test file is a PDF.

[TomKamin1]

I can confirm this with the following setup: creating a file link (Thunderbird filelink in this case). It creates a link like https://domain/index.php/s/SHARE-ID/download. When clicking in Firefox or Chrome, this works (even in a private window). When forwarding the link to my Chrome browser on my mobile, this doesn't work and gives me the same error message. Reloading doesn't help here (but copy/pasting the link will start the download).

I noticed that the parameter /?accept=zip is automatically added to the link. When I remove this (and also when I remove "download" from the link), the download works also fine with a click. My test file is a PDF.

You're right! Tweaking the link does make it work! Its a little extra work but at least for now i have a solution to keep it running correctly, thank you for that.

[TomKamin1]

I can confirm this with the following setup: creating a file link (Thunderbird filelink in this case). It creates a link like https://domain/index.php/s/SHARE-ID/download. When clicking in Firefox or Chrome, this works (even in a private window). When forwarding the link to my Chrome browser on my mobile, this doesn't work and gives me the same error message. Reloading doesn't help here (but copy/pasting the link will start the download).

I noticed that the parameter /?accept=zip is automatically added to the link. When I remove this (and also when I remove "download" from the link), the download works also fine with a click. My test file is a PDF.

Actually, testing further, forwarding the link without that /?accept=zip part still does not allow download unfortunately.

[socram70]

I think you might have an issue because the link structure changes once you clicked the link:
The sharing link leads via HTTP 303 to https://DOMAIN/public.php/dav/files/FILEID/?accept=zip

Removing the ?accept.zip there works fine. The only browser with which I got this issue is Chrome on Android. I tested Chrome and Firefox (newest version) on Windows 11 and on Ubuntu 24.04 LTS (without logging in and with login) and it works.

This is my curl -I output if it helps:

HTTP/1.1 303 See Other
Date: Thu, 01 May 2025 09:25:48 GMT
Server: Apache
X-Request-Id: aBM-HB2yp4JTFd9W3wGrxAAABUk
Cache-Control: no-cache, no-store, must-revalidate
Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
Feature-Policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
X-Robots-Tag: noindex, nofollow
Set-Cookie: oc_sessionPassphrase=OJRLZ9Ns6%2F8PT%2Bm%2BRZqwjLQviMwjEHfdrEWbqzh%2BGL7iuJ%2BR1ARIHO9xWR7VvyHB3EBcLjzrRmpyL%2F8ZBOH%2Fp2Rhu6gMX2qVF%2Bwv%2Bg1lDTW8%2FJ5h3of81oqBx3ejbjz%2B; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
Set-Cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
Set-Cookie: ocgm4ncrxtgb=9caa9f127dc9e30d54f5818111830a29; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer
Upgrade: h2,h2c
Connection: Upgrade
Location: https://DOMAIN/public.php/dav/files/FILEID/?accept=zip
Content-Type: text/html; charset=UTF-8

[TomKamin1]

I think you might have an issue because the link structure changes once you clicked the link: The sharing link leads via HTTP 303 to https://DOMAIN/public.php/dav/files/FILEID/?accept=zip

Removing the ?accept.zip there works fine. The only browser with which I got this issue is Chrome on Android. I tested Chrome and Firefox (newest version) on Windows 11 and on Ubuntu 24.04 LTS (without logging in and with login) and it works.

This is my curl -I output if it helps:

HTTP/1.1 303 See Other
Date: Thu, 01 May 2025 09:25:48 GMT
Server: Apache
X-Request-Id: aBM-HB2yp4JTFd9W3wGrxAAABUk
Cache-Control: no-cache, no-store, must-revalidate
Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'
Feature-Policy: autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'
X-Robots-Tag: noindex, nofollow
Set-Cookie: oc_sessionPassphrase=OJRLZ9Ns6%2F8PT%2Bm%2BRZqwjLQviMwjEHfdrEWbqzh%2BGL7iuJ%2BR1ARIHO9xWR7VvyHB3EBcLjzrRmpyL%2F8ZBOH%2Fp2Rhu6gMX2qVF%2Bwv%2Bg1lDTW8%2FJ5h3of81oqBx3ejbjz%2B; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
Set-Cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
Set-Cookie: ocgm4ncrxtgb=9caa9f127dc9e30d54f5818111830a29; path=/; secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer
Upgrade: h2,h2c
Connection: Upgrade
Location: https://DOMAIN/public.php/dav/files/FILEID/?accept=zip
Content-Type: text/html; charset=UTF-8

Yeah, that's what i did. After the link changes, removing the ?accept=zip does make it download right after as well as on copy & paste, but sending that link through facebook does in fact not work, with the same error as before :(

[artonge]

@TomKamin1 @socram70
I am failing to reproduce your issue. Could you give more some more information?

1. Is there a difference between the displayed link and the one you obtain from copying it?
2. Can you share a screenshot of what it looks like in the mail or chat?
3. Is the protocol correctly set to HTTPS in the link?

[stpalan]

@artonge
I just tried and put such a link into an email to myself. I can click the link on my PC (Windows 11/Outlook 365 desktop/Brave browser), but when I click it on my mobile (Pixel 9/Android 15/Nine email/Brave browser) I get the error message. A screenshot of the error message is at https://www.dropbox.com/scl/fi/fqvbwb4plmdzgvso9sowg/Nextcloud_2025-05-05.png?rlkey=l04v4i4lnll86yth9dxflxwfk&st=8626xytc&dl=0, the link would be https://cloud.uni-graz.at/s/T7ByYzBiW3c2yQR/download.

[stpalan]

I just tried and I can click the link on my PC (Windows 11/Outlook 365 desktop/Brave browser), but when I click it on my mobile (Pixel 9/Android 15/Nine email/Brave browser) I get the error message. A screenshot of the error message is at https://www.dropbox.com/scl/fi/fqvbwb4plmdzgvso9sowg/Nextcloud_2025-05-05.png?rlkey=l04v4i4lnll86yth9dxflxwfk&st=8626xytc&dl=0, the link would be https://cloud.uni-graz.at/s/T7ByYzBiW3c2yQR/download.

And if I click the link here on github on my PC, it again produces the error.

[plimo]

I am (or better: others that I share files with) facing the same problem. For me the problem reproduces using the cloud.uni-graz.at... link from @stpalan above with Firefox, Chrome and Edge. When simply clicking the link, the error occurs, when copying the link and inserting in a new browser window the download works flawlessly.

[socram70]

The same applies for me with the Android Chrome browser.

[artonge]

So, this only occurs when sharing the direct download URL: https://example.com/s/sharetoken/download.

From MDN:

Strict causes the browser to only send the cookie in response to requests originating from the cookie's origin site. This should be used when you have cookies relating to functionality that will always be behind an initial navigation.

From what I understand:

• samesite=strict cookies are not sent if the request is coming from a third party website.
• So the first request https://example.com/s/sharetoken/download lacks it
• And the redirect receives the same context, so https://example.com/public.php/dav/files/sharetoken/?accept=zip also lacks it.
• Nextcloud complains about the missing cookie.

Solutions:

• Add another exception for public.php here:

  server/lib/base.php

  Lines 554 to 559 in f26dc79

  	// index.php routes are handled in the middleware
  	// and cron.php does not need any authentication at all
  	if ($processingScript === 'index.php'
  	|| $processingScript === 'cron.php') {
  	return;
  	}

• Or something else?