Bug 505118 - kioworker accessing nextcloud CalDAV without credentials triggers bruteforce detection
Summary: kioworker accessing nextcloud CalDAV without credentials triggers bruteforce ...
Status: CONFIRMED
Alias: None
Product: frameworks-kio
Classification: Frameworks and Libraries
Component: WebDAV (other bugs)
Version First Reported In: 6.14.0
Platform: Other Linux
: NOR grave
Target Milestone: ---
Assignee: KIO Bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-06-02 08:01 UTC by Paul
Modified: 2025-06-04 05:49 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:

Attachments
Add an attachment

Note You need to log in before you can comment on or make changes to this bug.
Description Paul 2025-06-02 08:01:19 UTC 
SUMMARY
After upgrading my nextcloud instance, which now has bruteforce detection (https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/bruteforce_configuration.html), I noticed that I am constantly hitting the rate limit. After looking at my nginx (reverse proxy) logs, I noticed that kioworker seems to be the culprit. Every request is first attempted without credentials, leading to 401 Unauthorized.

Here a pseudonymized except from the nginx logs:

```
A.B.C.D - - [02/Jun/2025:09:40:03 +0200] "PROPFIND /remote.php/dav/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - peter [02/Jun/2025:09:40:12 +0200] "PROPFIND /remote.php/dav/ HTTP/1.1" 207 309 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - - [02/Jun/2025:09:40:13 +0200] "PROPFIND /remote.php/dav/principals/users/peter/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - peter [02/Jun/2025:09:40:17 +0200] "PROPFIND /remote.php/dav/principals/users/peter/ HTTP/1.1" 207 292 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - - [02/Jun/2025:09:40:17 +0200] "PROPFIND /remote.php/dav/calendars/peter/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - peter [02/Jun/2025:09:40:21 +0200] "PROPFIND /remote.php/dav/calendars/peter/ HTTP/1.1" 207 1028 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - - [02/Jun/2025:09:42:57 +0200] "PROPFIND /remote.php/dav/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - peter [02/Jun/2025:09:43:01 +0200] "PROPFIND /remote.php/dav/ HTTP/1.1" 207 309 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - - [02/Jun/2025:09:43:01 +0200] "PROPFIND /remote.php/dav/principals/users/peter/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - peter [02/Jun/2025:09:43:05 +0200] "PROPFIND /remote.php/dav/principals/users/peter/ HTTP/1.1" 207 292 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - - [02/Jun/2025:09:43:05 +0200] "PROPFIND /remote.php/dav/calendars/peter/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
A.B.C.D - peter [02/Jun/2025:09:43:09 +0200] "PROPFIND /remote.php/dav/calendars/peter/ HTTP/1.1" 207 1028 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.14 kioworker/6.14.0"
```

I added my nextcloud account in the "Online Accounts" settings option and am synchronizing my calendars with caldav.

I suppose the correct behavior of kioworker should be to use the credentials by default and not as a fallback.


SOFTWARE/OS VERSIONS
Linux/KDE Plasma: KDE Neon based on Ubuntu 24.04
KDE Plasma Version: 6.3.5
KDE Frameworks Version: 6.14.0
Qt Version: 6.9.0
Comment 1 TraceyC 2025-06-02 23:30:13 UTC 
I also have a Nextcloud instance set up with nginx and confirmed the problem with git-master

In Plasma, I don't have the NC account set up via "Online Accounts". The software accessing my Nextcloud instance is Thunderbird, the NC client, and apparently the plasma-browser-integration@kde.org process

I notice that both in your logs and mine, "Mozilla" is in the lines. This isn't Thunderbird, so on my machine this is from the Nextcloud client.

As a test, I closed Thunderbird, re-started, and initiated a sync.
I saw similar log lines with the 401 error, but with the client identifier
(X11; Linux x86_64; rv:139.0) Gecko/20100101 Thunderbird/139.0"
Sync attempts after the first do not produce a 401 error, they show 207 as expected

After exiting the NC client and re-starting, that didn't produce any 401s
I made sure no browser tabs were open to the NC instance, the only processes open referencing Mozilla are
- KeepassXC (which doesn't call out to NC)
- plasma-browser-integration@kde.org

So it seems that no matter which client uses kioworker to communicate with Nextcloud, except the NC client itself, the behavior is the same.

Log lines from my server:

/var/log/nginx ❯ rg -A 1 "PROPFIND.*401" | tail -6
nextcloud_https_access.log:A.B.C.D - - [02/Jun/2025:22:32:31 +0000] "PROPFIND /remote.php/dav/principals/users/tclark/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.15 kioworker/6.15.0"
nextcloud_https_access.log-A.B.C.D - tclark [02/Jun/2025:22:32:31 +0000] "PROPFIND /remote.php/dav/principals/users/tclark/ HTTP/1.1" 207 296 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.15 kioworker/6.15.0"
--
nextcloud_https_access.log:A.B.C.D - - [02/Jun/2025:22:32:32 +0000] "PROPFIND /remote.php/dav/addressbooks/users/tclark/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.15 kioworker/6.15.0"
nextcloud_https_access.log:A.B.C.D - - [02/Jun/2025:22:32:32 +0000] "PROPFIND /remote.php/dav/calendars/tclark/ HTTP/1.1" 401 596 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.15 kioworker/6.15.0"
nextcloud_https_access.log-A.B.C.D - tclark [02/Jun/2025:22:32:33 +0000] "PROPFIND /remote.php/dav/addressbooks/users/tclark/ HTTP/1.1" 207 451 "-" "Mozilla/5.0 (X11; Linux x86_64) KIO/6.15 kioworker/6.15.0"
Comment 2 Paul 2025-06-04 05:49:19 UTC 
I am also using Thunderbird to synchronize calendars. And I am using "Nextcloud Desktop Client Version 3.16.0daily (KDE)" to synchronize a folder. I initially didn't assume this was relevant.