Pausing a video in preview app triggers browser's login window after a while

[schweigisito]

Initial Checklist

• I understand this is a bug report and questions should be posted in the Community Discussions
• I searched issues and couldn’t find anything (or linked relevant results below)

Bug Description

While opening a video in preview app and pausing it, the browser opens a login window after some minutes. The login token refresh itself seems to work in the background. Nevertheless, after some minutes, a login window appears which cannot get clicked away.

Reproduction Steps

• Login to OpenCloud
• Open dev tools of the browser
• Open a video and play it
• Pause the video
• Monitor the login token refresh requests => they all get refreshed successfully
• Wait until the login window gets displayed

Expected Outcome

No login window and being able to resume playing the video as long the login token is valid.

Actual Outcome

=> After some minutes the browser opens a login window in result of the following request:

https://f.q.d.n/dav/spaces/55a7c140-8cd6-4714-ad18-c75b5363704d$4eab091e-47eb-4272-b8fb-f9df1e50b31b/video.webm?oc-jwt-sig=REMOVED_JWT

at

Date Tue, 01 Sep 2026 14:13:44 GMT

Having a look into JWT of the signed URL, it shows that the URL is already expired.

{
    "target_url": "https://f.q.d.n/dav/spaces/55a7c140-8cd6-4714-ad18-c75b5363704d$4eab091e-47eb-4272-b8fb-f9df1e50b31b/video.webm",
    "iss": "reva",
    "sub": "63ffe93e-ffd0-103f-9da3-09c187cc534a",
    "exp": 1788271781,
    "iat": 1788269981
}

while 1788271781 translates to

$ date -u -d @1788271781
Tue Sep  1 02:09:41 PM UTC 2026

The login window is the result of the expired signed URL, though.

[schweigisito]

My assumption is, that whenever the video file is paused for >30 minutes, which seems to be the hardcoded ttl for the signed url, this issue is triggered.

[schweigisito]

My assumption is, that whenever the video file is paused for >30 minutes, which seems to be the hardcoded ttl for the signed URL, this issue is triggered.

Confirmed

[kulmann]

The default TTL for client-side generated presigned urls as defined in packages/web-client/src/ocs/urlSign.ts is 20 minutes 🙈 I think the server side generated presigned urls are set to 24 hours. @rhafer do you know?

[rhafer]

The default TTL for client-side generated presigned urls as defined in packages/web-client/src/ocs/urlSign.ts is 20 minutes 🙈 I think the server side generated presigned urls are set to 24 hours. @rhafer do you know?

The server side generated signed urls are valid for 30min (there is currently no way to configure that otherwise). From a security perspective I think it would be a bad idea to make them valid for longer. Especially not for 24h.

I don't know how the videoplayer works exactly, does it really need to use the signed URL for accessing the file? Would it be possible to make it access files using the OIDC bearer token?

Would it help, if the server returned a more specific status code, like e.g. 410 (Gone), when the URL expired to indicate that the client needs to request a new signed URL? 🤔

[JammingBen]

I don't know how the videoplayer works exactly, does it really need to use the signed URL for accessing the file? Would it be possible to make it access files using the OIDC bearer token?

This won't work because we're embedding videos via <video>, which can't carry auth. That's the reason why we're using a signed URL here.

Would it help, if the server returned a more specific status code, like e.g. 410 (Gone), when the URL expired to indicate that the client needs to request a new signed URL? 🤔

Not quite I believe, because the <video> element receives the error and never forwards its code to our JS.

But we could do exactly 1 retry on any error by fetching a new URL and replacing the video's src with it. For this to work however, the server must drop the Www-Authenticate header on failed signed URL responses because this causes the browser popup. Normally, Web sends the X-Requested-With: XMLHttpRequest header to avoid this, but again this doesn't work with the video element.