Skip to content

[Bug]: Share-by-email fails with HTTP 400 "Tokens must contain at least 1 character" error #56168

@pbol01

Description

@pbol01

⚠️ This issue respects the following points: ⚠️

Bug description

Share-by-email feature fails with HTTP 400 error when NextCloud attempts to automatically update share permissions after creation. Error message displayed to user: "Tokens must contain at least 1 character and may only contain letters, numbers, or a hyphen" (misleading - actual issue is permission update validation failure).

Environment

  • NextCloud Version: 32.0.1
  • Container: LinuxServer.io (lscr.io/linuxserver/nextcloud:latest, tag 32.0.1-ls401)
  • PHP Version: 8.4.14
  • Database: PostgreSQL 18.0
  • Browser: Firefox/Chrome (tested both)
  • Share-by-mail App: v1.22.0 (enabled, default config)

Steps to reproduce

1.Navigate to Files in NextCloud web UI
2. Click share icon on any file
3. In sharing dialog, enter external email address (e.g., [email protected])
4. Select "Share by email" option
5. Click to create share

Expected behavior

Share is created successfully
Email notification is sent to recipient
Share appears in sharing list with proper permissions

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report

### NextCloud Configuration
- **Maintenance Mode**: false
- **Encryption**: Disabled
- **Two-Factor Auth**: Enabled (twofactor_backupcodes, twofactor_nextcloud_notification, twofactor_totp)
- **Brute Force Protection**: Enabled (bruteforcesettings v5.0.0)

### Relevant Apps
- **sharebymail**: v1.22.0 (enabled, default config)
- **files_sharing**: v1.24.0 (enabled)
- **Additional apps**: deck, forms, guests, richdocuments (Collabora), tasks, whiteboard

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - app_api: 32.0.0
  - bruteforcesettings: 5.0.0-dev.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - forms: 5.2.2
  - guests: 4.6.0
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - richdocuments: 9.0.1
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - systemtags: 1.22.0
  - tasks: 0.17.0
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - whiteboard: 1.4.0
  - workflowengine: 2.14.0
Disabled:
  - admin_audit: 1.22.0
  - encryption: 2.20.0
  - files_external: 1.24.0
  - firstrunwizard: 5.0.0-dev.0 (installed 5.0.0-dev.0)
  - nextcloud_announcements: 4.0.0-dev.0 (installed 4.0.0-dev.0)
  - recommendations: 5.0.0-dev.0 (installed 5.0.0-dev.0)
  - related_resources: 3.0.0-dev.0 (installed 3.0.0-dev.0)
  - support: 4.0.0-dev.0 (installed 4.0.0-dev.0)
  - survey_client: 4.0.0-dev.0 (installed 4.0.0-dev.0)
  - suspicious_login: 10.0.0-dev.0
  - twofactor_totp: 14.0.0
  - user_ldap: 1.23.0

Nextcloud Signing status

Passed (no core file modifications)

Nextcloud Logs

Additional info

NextCloud Application Logs

Critical Finding: No share-related errors logged in nextcloud.log during bug reproduction.

Checked:

  • Log file: /data/nextcloud.log (65KB, last modified Oct 25)
  • Log level: 0 (default - Warnings and errors)
  • Searched for: share, sharebymail, token, 400, error patterns
  • Result: HTTP 400 error ONLY appears in browser console, not in server logs

This is significant evidence that:

  1. The backend accepts the share creation (no server-side error logged)
  2. The error occurs during the frontend-initiated PUT request
  3. Backend rejects the permission update silently (returns 400 without logging)
  4. Suggests API validation issue rather than backend crash/error

Sample Log Entry Format

{
  "reqId":"example123",
  "level":3,
  "time":"2025-10-25T19:50:00+00:00",
  "remoteAddr":"10.10.0.1",
  "user":"peter",
  "app":"files_sharing",
  "method":"PUT",
  "url":"/ocs/v2.php/apps/files_sharing/api/v1/shares/6",
  "message":"Share update validation failed"
}

Expected but NOT found: No such entries exist for the failed share operations.

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions