Login Flow v2 is restarted after the first successful grant, so every new account has to be granted twice #17821

⚠️ Before posting ⚠️

• This is a bug, not a question or an enhancement.
• I've searched for similar issues and didn't find a duplicate.
• I've written a clear and descriptive title for this issue, not just "Bug" or "Crash".
• I agree to follow Nextcloud's Code of Conduct.

Steps to reproduce

1. Use a server with TOTP two-factor authentication enforced, and a phone browser that is not signed in to Nextcloud.
2. In the app, add an account: enter the server URL and continue with the browser login (Login Flow v2).
3. In the browser, enter the password and the TOTP code, then tap "Grant access". The browser shows "Account connected".
4. Switch back to the app.

Expected behaviour

The app polls /login/v2/poll, picks up the app password from the grant of step 3 and creates the account.

Actual behaviour

The app never polls for the first flow. When I switch back to it, it starts a new Login Flow v2 (status.php, HEAD /remote.php/dav, POST /index.php/login/v2) and opens the browser again. This time the browser is already signed in, so only "Grant access" is needed; the app then polls within 2 seconds and the account is created.

So every login needs two grants, and the first grant leaves an app password on the server that no client ever uses (an extra "Nextcloud-android" device under Settings → Security).

Reverse proxy access log of one attempt with 35.0.1 (UTC, tokens removed). App = Mozilla/5.0 (Android) Nextcloud-android/35.0.1, browser = Mozilla/5.0 (Linux; Android 10; K) … Chrome/154.0.0.0 Mobile Safari/537.36:

19:24:05 app      GET  /status.php                         200
19:24:05 app      HEAD /remote.php/dav                     401
19:24:05 app      POST /index.php/login/v2                 200   <- flow 1
19:24:07 browser  GET  /login/v2/flow/…                    303
19:24:09 browser  GET  /login?redirect_url=/login/v2/grant… 200
19:24:26 browser  POST /login                              303
19:24:26 browser  GET  /login/challenge/totp?…             200
19:25:56 browser  POST /login/challenge/totp?…             303
19:25:56 browser  GET  /login/v2/grant?…                   200
19:25:58 browser  POST /login/v2/grant                     200   <- flow 1 granted ("Account connected")
                  (no /login/v2/poll at all for flow 1)
19:26:18 app      GET  /status.php                         200
19:26:18 app      HEAD /remote.php/dav                     401
19:26:18 app      POST /index.php/login/v2                 200   <- flow 2, started by the app on its own
19:26:19 browser  GET  /login/v2/flow/…                    303
19:26:20 browser  GET  /login/v2/grant?…                   200
19:26:22 browser  POST /login/v2/grant                     200   <- flow 2 granted
19:26:24 app      POST /login/v2/poll                      200   <- account created

The dev build 20261009 does exactly the same: flow 1 granted at 18:54:37, new flow started by the app at 18:55:04, flow 2 granted at 18:55:27 and polled at 18:55:45.

The difference between the two flows is the time spent in the browser: the first one goes through the password and TOTP pages (55 s to 1 min 53 s), the second one is a single "Grant access" tap (3 to 6 s). It looks as if the pending flow is lost when the app stays in the background for longer, for example because the activity is recreated, and the app then starts over instead of polling the token it already has.

Android version

14 (API 34)

Device brand and model

Xiaomi 22041219PG (thunder)

Stock or custom OS?

Stock

Nextcloud android app version

35.0.1 (also reproduced with dev 20261009)

Nextcloud server version

34.0.4

Using a reverse proxy?

Yes

Android logs

I don't have a logcat of the failing attempt yet. I can capture one if it helps; the LoginFlowV2 lifecycle logging from #17360 is not in 35.0.1.

Server error logs

Nothing related to the app. The server log only has the usual "Could not find the session token to renew" entries for the unauthenticated browser requests.

Additional information

• Caddy 2.11.7 as reverse proxy on a non-standard HTTPS port (https://cloud.example.com:60443, real name replaced). overwrite.cli.url uses the same URL.
• TOTP 2FA is enforced for all users.
• Possibly related: Android client stuck on "Waiting for browser" after successful Login Flow v2 approval (Android 16) #16323 (app stuck on "Waiting for browser" after a successful grant). In a comment there, the QA APK of fix(login): lifecycle #17360 "keeps asking for new grants in endless loop". Here the loop stops after the second grant, presumably because the second flow is short.