chore(cypress): Try to analyze failures

Assisted-by: ClaudeCode:claude-fable-5
Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>

Author: DerDreschner

core/Controller/CSRFTokenController.php

@@ -63,10 +63,19 @@ public function index(): JSONResponse {
 		try {
 			$session = \OCP\Server::get(\OCP\ISession::class);
 			$raw = $this->request->getCookie(session_name());
+			// Hash of the raw token value stored in this session. The matching
+			// /login line logs the same storedTok; if they differ (or /login has
+			// none) the two requests hit different sessions -> csrfCheckFailed.
+			$storedTok = 'n/a';
+			$t = $session->get('requesttoken');
+			if (is_string($t) && $t !== '') {
+				$storedTok = substr(md5($t), 0, 8);
+			}
 			\OCP\Server::get(\Psr\Log\LoggerInterface::class)->error(
 				'[login-diag] CSRFTOKEN issued remote=' . $this->request->getRemoteAddress()
 				. ' session=' . substr(md5((string)$session->getId()), 0, 8)
-				. ' sessCookie=' . ($raw !== null ? substr(md5($raw), 0, 8) : 'none'),
+				. ' sessCookie=' . ($raw !== null ? substr(md5($raw), 0, 8) : 'none')
+				. ' storedTok=' . $storedTok,
 				['app' => 'login-diag'],
 			);
 		} catch (\Throwable) {

core/Controller/LoginController.php

@@ -416,6 +416,29 @@ private function logLoginDiag(string $what, string $user): void {
 			} catch (\Throwable) {
 				$sessCookie = 'err';
 			}
+			// Hash of the raw CSRF token value STORED in this session, and of the
+			// value the client PROVIDED. If the /login session is the same one
+			// /csrftoken issued into, storedTok here must equal the storedTok that
+			// CSRFTOKEN logged. A mismatch proves the two requests hit different
+			// sessions (or the token rotated) — the real csrfCheckFailed cause.
+			$storedTok = 'n/a';
+			try {
+				$t = $this->session->get('requesttoken');
+				if (is_string($t) && $t !== '') {
+					$storedTok = substr(md5($t), 0, 8);
+				}
+			} catch (\Throwable) {
+				$storedTok = 'err';
+			}
+			$providedTok = 'none';
+			try {
+				$p = $this->request->getParam('requesttoken');
+				if (is_string($p) && $p !== '') {
+					$providedTok = substr(md5($p), 0, 8);
+				}
+			} catch (\Throwable) {
+				$providedTok = 'err';
+			}
 			\OCP\Server::get(\Psr\Log\LoggerInterface::class)->error(
 				'[login-diag] ' . $what
 				. ' user=' . $user
@@ -424,6 +447,8 @@ private function logLoginDiag(string $what, string $user): void {
 				. ' sessCookie=' . $sessCookie
 				. ' strictCookie=' . $strictCookie
 				. ' sessHasReqToken=' . $sessHasReqToken
+				. ' storedTok=' . $storedTok
+				. ' providedTok=' . $providedTok
 				. ' csrf=' . ($this->request->passesCSRFCheck() ? '1' : '0')
 				. ' origin=' . $this->request->getHeader('Origin')
 				. ' delay=' . $this->throttler->getDelay($remote, 'login'),