nextcloud/server · error · Sabre\DAV\Exception\NotAuthenticated

Cannot authenticate over ajax calls

Error message

Cannot authenticate over ajax calls

What it means

Error "Cannot authenticate over ajax calls" thrown in nextcloud/server.

Source

Thrown at apps/dav/lib/Connector/Sabre/PublicAuth.php:201

				// Validate password if provided
				if ($this->shareManager->checkPassword($share, $password)) {
					// If not set, set authenticated session cookie
					if (!$this->isShareInSession($share)) {
						$this->addShareToSession($share);
					}
					return true;
				}

				// We are already authenticated for this share in the session
				if ($this->isShareInSession($share)) {
					return true;
				}

				if (in_array('XMLHttpRequest', explode(',', $this->request->getHeader('X-Requested-With')))) {
					// do not re-authenticate over ajax, use dummy auth name to prevent browser popup
					http_response_code(401);
					header('WWW-Authenticate: DummyBasic realm="' . $this->realm . '"');
					throw new NotAuthenticated('Cannot authenticate over ajax calls');
				}

				$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
				return false;
			} elseif ($share->getShareType() === IShare::TYPE_REMOTE) {
				return true;
			}

			$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
			return false;
		}

		return true;
	}

	public function getShare(): IShare {
		$token = $this->getToken();

View on GitHub (pinned to ecdeb153ff)

When it happens

Trigger: Thrown at apps/dav/lib/Connector/Sabre/PublicAuth.php:201 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/44725059ad4e3722. Report an issue: GitHub.