[Bug]: NC WebGUI _partially_ dead slow (reacts in multiples of around 30 secs)

[joe-average-user]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Take a look at these consecutive lines from nextcloud.log showing a simple login page reload (no login!). The timeSpent is suspiciously near to multiples of 30 seconds.

{“reqId”:“qWXYdPUViUSFGDR0jeIL”,“level”:3,“time”:“2026-01-13T09:11:30+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark.css?plain=0&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“31.459174871444702”}}
{“reqId”:“KBAwGZ3eIwjB2nx1Jx4g”,“level”:3,“time”:“2026-01-13T09:12:01+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark-highcontrast.css?plain=0&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“62.1520779132843”}}
{“reqId”:“LR0sPWHsaungtWW1xpXd”,“level”:3,“time”:“2026-01-13T09:12:32+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/favicon?v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“30.662110805511475”}}
{“reqId”:“Qdpj0B96qq13e4Kc1zvq”,“level”:3,“time”:“2026-01-13T09:13:02+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark-highcontrast.css?plain=1&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“61.243382930755615”}}
{“reqId”:“vWdKSTsq6w9zupdNbPMQ”,“level”:3,“time”:“2026-01-13T09:13:33+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/image/logo?v=25”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“91.97107720375061”}}
{“reqId”:“ENz9qNvg6QMXNaeUoNiG”,“level”:3,“time”:“2026-01-13T09:14:04+01:00”,“remoteAddr”:“A.B.C.D”,“user”:“–”,“app”:“no app in context”,“method”:“GET”,“url”:“/index.php/apps/theming/theme/dark.css?plain=1&v=fe824373”,“message”:“Slow session operation session_start detected”,“userAgent”:“Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0”,“version”:“30.0.17.2”,“data”:{“parameters”:“\[{"cookie_samesite":"Lax"}\]”,“timeSpent”:“122.69037103652954”}}

Steps to reproduce

The problem persists through all updates I made in NC30. Since this is a setup coming from around NC14, but has developed the problem only since NC30.
My suspicion is something about the brute force protection, but it is disabled in config. Is it possible that the disabling does not really work well?

Expected behavior

Clearly this should not happen at all.

Nextcloud Server version

30

Operating system

Other

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "default_language": "de",
        "trusted_domains": {
                *** REMOVED ***
        },
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "filesystem_check_changes": 1,
        "filelocking.enabled": true,
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "password": "***REMOVED SENSITIVE VALUE***",
            "timeout": 0
        },
        "logfile": "\/srv\/user-local\/cloud.default\/log\/nextcloud.log",
        "overwrite.cli.url": "*** REMOVED ***",
        "dbtype": "mysql",
        "version": "30.0.17.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "Europe\/Berlin",
        "installed": true,
        "chunkSize": "2048MB",
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcached_servers": [
            [
                "127.0.0.1",
                11211
            ]
        ],
        "loglevel": 1,
        "user_backends": [
            {
                "class": "\\OCA\\UserExternal\\***REMOVED***",
                "arguments": []
            }
        ],
        "maintenance": false,
        "theme": "",
        "trashbin_retention_obligation": "auto, 30",
        "appstore.experimental.enabled": true,
        "mail_smtpauthtype": "PLAIN",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "stable",
        "mysql.utf8mb4": true,
        "app_install_overwrite": [
            "groupquota",
            "keeweb",
            "passman",
            "whiteboard",
            "user_external"
        ],
        "default_phone_region": "DE",
        "mail_sendmailmode": "smtp",
        "maintenance_window_start": 1,
        "auth.bruteforce.protection.enabled": false,
        "enable_previews": true,
        "enabledPreviewProviders": [
            "OC\\Preview\\BMP",
            "OC\\Preview\\GIF",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\Krita",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\MP3",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\PNG",
            "OC\\Preview\\TXT",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\Imaginary"
        ],
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - app_api: 4.0.6
  - audioplayer: 3.7.0
  - bruteforcesettings: 3.0.0
  - calendar: 5.5.12
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.3.10
  - contactsinteraction: 1.11.0
  - cpanelmailsync: 0.1.7
  - dashboard: 7.10.0
  - dav: 1.31.1
  - deck: 1.14.8
  - drawio: 3.0.9
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_retention: 1.19.1
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - groupquota: 0.2.3
  - integration_dropbox: 4.1.0
  - integration_google: 4.2.0
  - integration_onedrive: 3.5.0
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - nextcloud_announcements: 2.0.0
  - notes: 4.12.4
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - passman: 2.4.12
  - password_policy: 2.0.0
  - photos: 3.0.2
  - polls: 8.3.10
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - richdocuments: 8.5.13
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - spreed: 20.1.11
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - tasks: 0.16.1
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - updatenotification: 1.20.0
  - user_external: 3.4.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - encryption: 2.18.0
  - files_external: 1.22.0 (installed 0.2.3)
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - files_texteditor: 2.15.1 (installed 2.15.1)
  - keeweb: 0.6.22 (installed 0.6.22)
  - news: 26.1.0 (installed 26.1.0)
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0
  - user_pwauth: 2.8.3 (installed 2.8.3)
  - whiteboard: 1.4.2 (installed 1.4.2)

Nextcloud Signing status

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- user_external
	- INVALID_HASH
		- appinfo/info.xml
	- EXTRA_FILE
		- lib/ITH.php

Raw output
==========
Array
(
    [user_external] => Array
        (
            [INVALID_HASH] => Array
                (
                    [appinfo/info.xml] => Array
                        (
                            [expected] => 797562cccd7ac9d6f1d01c0fde0a4d6657302fe1488f96bf0b93a143e9f46bb8a86e98663c83650ef19689fff63f959598e5495895f81e4be08cd4962cbdeaac
                            [current] => 9f80d34251539b649bda5c636d1eaaa7284f1a286c0150f2d970c3eb0bd4cb8a005849877823b20dacc5c0f662617807400f046a06a0eca7cd44df3532ecd054
                        )

                )

            [EXTRA_FILE] => Array
                (
                    [lib/ITH.php] => Array
                        (
                            [expected] => 
                            [current] => 0f077f9dd0e1f119b21d9a01bb066dbfb429502c03c0ee6bb81b06a56f8dd42e5546ab3f09dd0ffb4a20ad2dab4d6af26e52e6d660baf3a0a2ceb875fe34f665
                        )

                )

        )

)

Nextcloud Logs

See the nextcloud.log entries above

Additional info

Arch Linux base
Please ignore the signing status, as the module warned about is our login service attached to user_external and is used for years now.

[susnux]

We did not receive any similar issues, so I guess this is caused by your PHP configuration.
More specific I suspect the session handler is the problem, you might try to use redis as the PHP session handler.

Could also be caused if your custom plugin is keeping a session open as sessions are locking for PHP.

I recommend to play around with the PHP config for the session handler and you can use our forums for further tracing.

[joe-average-user]

Thank you for your reaction on the issue.
I might explain, that I would not expect too many of these reports either, because we do one thing that seems not very common amongst NC users, we disable the brute force protection. In fact let me ask if you have ever had a similar long running NC setup without brute force protection at all.
I doubt that it is possible to delay the web output of the login page in the shown manner by a bogus PHP session handling. The reason I state that is that the problem persists even with a single browser reload of the login page and all other possible connections locked away by iptables rules. A single browser doing a page reload without any login is showing the nextcloud-log lines I showed. How can it be delayed overall for 2 mins?
I have not expected an immediate fix for the problem, instead I had the idea that some kind soul here can explain how I can modify the brute force delay of 30 secs to another value. I want to cross-check if the timeSpent stay as they are or follow the modified delay. Can you point me to the corresponding code in the server?
Thank you!
PS: This seems a bit over the abilities in the forum, at least there was no feedback there pinpointing an exact spot...

[joshtrichards]

has developed the problem only since NC30. My suspicion is something about the brute force protection

Brute Force Protection predates v30. It also generates log messages, particularly at loglevel 1. IMO this is highly unlikely to be related to BFP.

This is much more likely to be elsewhere.

But please check the basics first:

• PHP session save handler (https://www.php.net/manual/en/session.configuration.php#ini.session.save-handler)
• Any non-default PHP session configuration values

Your Nextcloud configuration also suggests you have (had?) a memcached (not just Redis) server in your environment. Depending on your PHP handler config, that or may not be relevant.

Can you point me to the corresponding code in the server?

server/lib/private/Security/Bruteforce/Throttler.php

Lines 134 to 158 in 94b5812

	public function getDelay(string $ip, string $action = ''): int {
	$attempts = $this->getAttempts($ip, $action);
	return $this->calculateDelay($attempts);
	}
	/**
	* {@inheritDoc}
	*/
	public function calculateDelay(int $attempts): int {
	if ($attempts === 0) {
	return 0;
	}
	$firstDelay = 0.1;
	if ($attempts > $this->config->getSystemValueInt('auth.bruteforce.max-attempts', self::MAX_ATTEMPTS)) {
	// Don't ever overflow. Just assume the maxDelay time:s
	return self::MAX_DELAY_MS;
	}
	$delay = $firstDelay * 2 ** $attempts;
	if ($delay > self::MAX_DELAY) {
	return self::MAX_DELAY_MS;
	}
	return (int)\ceil($delay * 1000);
	}

server/lib/public/Security/Bruteforce/IThrottler.php

Line 36 in 94b5812

public const MAX_DELAY_MS = 25000; // in milliseconds