{"record":{"id":"44725059ad4e3722","repo":"nextcloud/server","slug":"cannot-authenticate-over-ajax-calls","errorCode":null,"errorMessage":"Cannot authenticate over ajax calls","messagePattern":"Cannot authenticate over ajax calls","errorType":"exception","errorClass":"Sabre\\DAV\\Exception\\NotAuthenticated","httpStatus":401,"severity":"error","filePath":"apps/dav/lib/Connector/Sabre/PublicAuth.php","lineNumber":201,"sourceCode":"\t\t\t\t// Validate password if provided\n\t\t\t\tif ($this->shareManager->checkPassword($share, $password)) {\n\t\t\t\t\t// If not set, set authenticated session cookie\n\t\t\t\t\tif (!$this->isShareInSession($share)) {\n\t\t\t\t\t\t$this->addShareToSession($share);\n\t\t\t\t\t}\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\n\t\t\t\t// We are already authenticated for this share in the session\n\t\t\t\tif ($this->isShareInSession($share)) {\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\n\t\t\t\tif (in_array('XMLHttpRequest', explode(',', $this->request->getHeader('X-Requested-With')))) {\n\t\t\t\t\t// do not re-authenticate over ajax, use dummy auth name to prevent browser popup\n\t\t\t\t\thttp_response_code(401);\n\t\t\t\t\theader('WWW-Authenticate: DummyBasic realm=\"' . $this->realm . '\"');\n\t\t\t\t\tthrow new NotAuthenticated('Cannot authenticate over ajax calls');\n\t\t\t\t}\n\n\t\t\t\t$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());\n\t\t\t\treturn false;\n\t\t\t} elseif ($share->getShareType() === IShare::TYPE_REMOTE) {\n\t\t\t\treturn true;\n\t\t\t}\n\n\t\t\t$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());\n\t\t\treturn false;\n\t\t}\n\n\t\treturn true;\n\t}\n\n\tpublic function getShare(): IShare {\n\t\t$token = $this->getToken();\n","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Connector/Sabre/PublicAuth.php#L183-L219","documentation":"Error \"Cannot authenticate over ajax calls\" thrown in nextcloud/server.","triggerScenarios":"Thrown at apps/dav/lib/Connector/Sabre/PublicAuth.php:201 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}