Nextcloud: CSRF check failed on login or save

What the message looks like

CSRF check failed

Common causes

• Session cookie not stored, e.g. a Secure cookie over HTTP behind a TLS proxy.
• Reverse proxy without matching overwriteprotocol and trusted_proxies.
• PHP cannot write sessions (permissions on session.save_path, full disk).
• Redis as session store unreachable or full.
• Login page left open too long so the session expired, or access via two different hostnames.

Check

1. Check whether and how the session cookie is set
   curl -sI https://cloud.example.com/login | grep -i '^set-cookie'Copy
2. Show the Nextcloud proxy settings
   sudo -u www-data php /var/www/nextcloud/occ config:system:get overwriteprotocol; sudo -u www-data php /var/www/nextcloud/occ config:system:get trusted_proxiesCopy
3. Show PHP session storage
   php -i | grep -E 'session.save_(handler|path)'Copy
4. Show cache and Redis configuration
   sudo -u www-data php /var/www/nextcloud/occ config:system:get memcache.distributed; sudo -u www-data php /var/www/nextcloud/occ config:system:get redisCopy

Fix

• Behind a TLS proxy set 'overwriteprotocol' => 'https' and add the proxy IP to trusted_proxies.
• Always use the same hostname and set overwrite.cli.url to match.
• Make the session directory writable or check Redis: redis-cli ping.
• Clear browser cookies for the domain and reload the login page.
• Check disk space – without free space session files fail silently.

FAQ

Is “CSRF check failed” an attack?

In practice almost never. It means the token from the form does not match the current session – usually a lost or new session.

Why does it only hit some users?

Often browser extensions, blocked cookies or a bookmark to a different hostname are to blame. A private window narrows it down quickly.