[Bug]: HMAC does not match. Could not decrypt or decode encrypted session data

[AndyXheli]

Tip

This issue has multiple potential causes, but a common one can be resolved through a configuration change.

• If you are a user of Nginx Proxy Manager (NPM), try disabling the Cache Assets setting in your NPM configuration. This often resolves the problem.

---

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Getting following error on NC 28 RC4. Might be the same as #41254 (comment)

Steps to reproduce

Not Sure

Expected behavior

Not Sure

Installation method

Community Manual installation with Archive

Nextcloud Server version

28

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 22 to 23)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

{"reqId":"FuMPRjC8eJRqt0MgX7ET","level":3,"time":"2023-12-10T16:02:10-06:00","remoteAddr":"172.58.164.60","user":"--","app":"no app in context","method":"REPORT","url":"/remote.php/dav/files/axheli","message":"Could not decrypt or decode encrypted session data","userAgent":"Mozilla/5.0 (iOS) Nextcloud-iOS/4.9.3","version":"28.0.0.10","exception":{"Exception":"Exception","Message":"HMAC does not match.","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/private/Security/Crypto.php","line":119,"function":"decryptWithoutSecret","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Session/CryptoSessionData.php","line":90,"function":"decrypt","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Session/CryptoSessionData.php","line":67,"function":"initializeSession","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/var/www/nextcloud/lib/private/Session/CryptoWrapper.php","line":112,"function":"__construct","class":"OC\\Session\\CryptoSessionData","type":"->"},{"file":"/var/www/nextcloud/lib/base.php","line":449,"function":"wrapSession","class":"OC\\Session\\CryptoWrapper","type":"->"},{"file":"/var/www/nextcloud/lib/base.php","line":705,"function":"initSession","class":"OC","type":"::"},{"file":"/var/www/nextcloud/lib/base.php","line":1200,"function":"init","class":"OC","type":"::"},{"file":"/var/www/nextcloud/remote.php","line":119,"args":["/var/www/nextcloud/lib/base.php"],"function":"require_once"}],"File":"/var/www/nextcloud/lib/private/Security/Crypto.php","Line":158,"message":"Could not decrypt or decode encrypted session data","exception":[],"CustomMessage":"Could not decrypt or decode encrypted session data"},"id":"6577154851e3b"}

Additional info

No response

[Mr-Maniac]

I also get this log when Thunderbird syncs CardDAV/CalDAV via App password (2FA enabled for "normal" account). But not from android / DAVx5

EDIT: Also seems to happen when Browser (Firefox) is freshly opened and I open Nextcloud.

Nextcloud Server Version 28.0.0 (upgraded via web updater)

OS: Gentoo Linux - Kernel 6.1.67-gentoo

PHP 8.2.13

Webserver: Apache

DB: Postgres

DB user backend

No server encryption

Log:
{"reqId":"eHty4HYgC7PZkqoE7Azl","level":3,"time":"2023-12-18T22:31:52+01:00","remoteAddr":"fd00::a7d3:7ce8:c4d3:6189","user":"--","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/addressbooks/users/XXX/contacts/","message":"Could not decrypt or decode encrypted session data","userAgent":"Thunderbird CardBook/92.1","version":"28.0.0.11","exception":{"Exception":"Exception","Message":"HMAC does not match.","Code":0,"Trace":[{"file":"/mnt/web/nextcloud/lib/private/Security/Crypto.php","line":119,"function":"decryptWithoutSecret","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/mnt/web/nextcloud/lib/private/Session/CryptoSessionData.php","line":90,"function":"decrypt","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/mnt/web/nextcloud/lib/private/Session/CryptoSessionData.php","line":67,"function":"initializeSession","class":"OC\\Session\\CryptoSessionData","type":"->","args":[]},{"file":"/mnt/web/nextcloud/lib/private/Session/CryptoWrapper.php","line":112,"function":"__construct","class":"OC\\Session\\CryptoSessionData","type":"->","args":[["OC\\Session\\Internal"],["OC\\Security\\Crypto"],"*** sensitive parameters replaced ***"]},{"file":"/mnt/web/nextcloud/lib/base.php","line":449,"function":"wrapSession","class":"OC\\Session\\CryptoWrapper","type":"->","args":[["OC\\Session\\Internal"]]},{"file":"/mnt/web/nextcloud/lib/base.php","line":705,"function":"initSession","class":"OC","type":"::","args":[]},{"file":"/mnt/web/nextcloud/lib/base.php","line":1200,"function":"init","class":"OC","type":"::","args":[]},{"file":"/mnt/web/nextcloud/remote.php","line":119,"args":["/mnt/web/nextcloud/lib/base.php"],"function":"require_once"}],"File":"/mnt/web/nextcloud/lib/private/Security/Crypto.php","Line":158,"message":"Could not decrypt or decode encrypted session data","exception":[],"CustomMessage":"Could not decrypt or decode encrypted session data"},"id":"6580bb340ff49"}

[o-live-r]

I get the same bug using ubuntu 22.04.03 LTS (VM) with mariadb and nginx

[rrose-github]

I just did a clean install of Nextcloud 28.0.0 on Ubuntu 22.04 LTS using nginx, PHP 8.2, and PostgreSQL as the database. I too have received the exception "HMAC does not match. Could not decrypt or decode encrypted session data"

Given the timestamp of the exception, I probably was accessing the server using the Nextcloud iOS app.

[BJKle]

@rrose-github that's it. When I open the latest NC iOS App the error gets thrown. Now I know why I have so many of these errors. Hopefully it gets fixed soon.

[AndyXheli]

Hi @marinofaggiana Is this something that needs to be address on iOS app or on the server end ?

[johnczer]

I saw this error only one time when trying to open a document in Nextcloud from IOS device over cellular. But it was because I was blocking access to Collabora online port. Once I opened the port to CODE again this error did not reappear.

[IssueFindings]

Hello, I have the same issue. In my case, last version NextCloud/PHP/Nginx installation with Nextcloud mac Legacy client, when I turn off the plugin "End-to-end encryption" everything works again. I think this plugin is not fulling tested with the last NextCloud server version. Have a nice Christmas day !

[rrose-github]

Just to update my previous mention of getting the HMAC error when access the Nextcloud server from my iPhone. The version of the Nextcloud iOS app that I have installed is "Nextcloud Liquid for iOS 4.9.6.1". I don't have Collabora or any VPN software installed. Presumably the iPhone was utilizing my WiFi connection, and not cellular.

[rrose-github]

As an additional follow-up, the HMAC error is seeming to happening when I first attempt to play a MP3 that are on my Nextcloud account. At this time, I'm not sure if that is the only time the HMAC error is generated, but playing a MP3 seems to usually trigger the issue.

For anyone else getting this error, the "work-around solution" that I found was to add these lines to the /lib/systemd/system/php8.2-fpm.service file under the [Service] section:

Restart=on-failure
RestartSec=1s 

After modifying the service file, you also need to execute this statement:
sudo systemctl daemon-reload

When the HMAC error is generated in Nextcloud, php8.2-fpm is being killed with a "oom-kill". The above lines will cause Linux to automatically restart php8.2-fpm, restoring everything to normal. Also, after php8.2-fpm is restarted, the Nextcloud iOS app is able to play the audio file.

NOTE: I happen to have version 8.2 of php installed on this system. If you have a different version of php installed, then the version number in the filename will change accordingly.

[GrahamTolhurst]

Nextcloud 28.01, Ubuntu Server 22.04.3, Apache 2.4.58, MariaDB 10.6.12, PHP 8.2.14, Nextcloud Default Encryption Module disabled.

I'm getting the exact same problem. However, I can't find a trigger for it. Some of the posts above highlight actions that cause this, but none of them reliably trigger this in the Nextcloud log. When I notice the log entry, the timestamp is always several hours ago, and I can't remember what I was doing at the time.

I have the iOS Nextcloud app, but opening and browsing through that doesn't trigger this event. I have Calendar and Contacts synching with my iPhone Calendar and Contacts, but a manual sync doesn't trigger it. I have Joplin on more than one PC, synching via local folders, and also on my iPhone synching via WebDAV URL with an app specific password assigned in Settings-Personal Security-Devices & sessions.

I also have Home Assistant (on a Raspberry Pi) that is connected to my Nextcloud with an app specific password.

In the raw log entry, there is a reference to iOS, so the problem may be triggered by something on my iPhone. Manually synching any of my connected app/services doesn't trigger this event.