[Bug]: Cannot confirm password dialog / Internal error "Required authorization header missing" gets thrown

[Choppel]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

We have two Nextcloud instances. The first one was installed years ago, recently updated to the newest version and has no problems. The second one was freshly installed and is therefore up-to-date. I mention the first Nextcloud instance to highlight the fact, that an identically configured Nextcloud instance that already existed, has no problem.

The second Nextcloud has the following problem:
Installing the plugin "External storage support" shows a "Password confirmation" dialog. Entering the correct password throws an HTTP 403 error with the message "Required authorization header missing".
I then installed it via OCC. This worked instantly. I then tried to add an external storage via the web interface. The dialog and the subsequent error appeared again.

Steps to reproduce

1. Install and configure Nextcloud.
2. Install the "External storage support" plugin.

Expected behavior

I'd expect the dialog to work.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "my.domain.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.1.2",
        "overwrite.cli.url": "https:\/\/my.domain.com",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwritehost": "my.domain.com",
        "overwriteprotocol": "https",
        "overwritewebroot": "\/nextcloud",
        "overwritecondaddr": "^127\\.0\\.0\\.1$",
        "skeletondirectory": "",
        "default_phone_region": "DE",
        "maintenance_window_start": 1,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\APCu",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": true,
        "mail_smtpport": "587",
        "mail_sendmailmode": "smtp",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        },
        "maintenance": false,
        "app_install_overwrite": []
    }
}

List of activated Apps

Enabled:
  - app_api: 34.0.0
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contactsinteraction: 1.15.0
  - dashboard: 7.14.0
  - dav: 1.39.0
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_downloadlimit: 5.2.0-dev.0
  - files_external: 1.26.0
  - files_lock: 34.0.0
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_versions: 1.27.0
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - office: 1.0.0
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - related_resources: 5.0.0-dev.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - support: 6.0.0
  - systemtags: 1.24.0
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - activity: 7.0.0 (installed 7.0.0)
  - admin_audit: 1.24.0
  - encryption: 2.22.0
  - files_trashbin: 1.24.0 (installed 1.24.0)
  - firstrunwizard: 7.0.0-dev.0 (installed 7.0.0-dev.0)
  - nextcloud_announcements: 6.0.0 (installed 6.0.0)
  - recommendations: 7.0.0 (installed 7.0.0)
  - survey_client: 6.0.0-dev.0 (installed 6.0.0-dev.0)
  - suspicious_login: 12.0.0-dev.0
  - twofactor_nextcloud_notification: 8.0.0
  - user_ldap: 1.25.0

Nextcloud Signing status

Failure: 404

1 /index.php/settings/integrity/failed

Nextcloud Logs

{
  "reqId": "tHyAPBV3ej2wIvPbFsWB",
  "level": 0,
  "time": "2026-07-21T10:17:44+00:00",
  "remoteAddr": "1.2.3.4",
  "user": "root",
  "app": "files_external",
  "method": "POST",
  "url": "/nextcloud/index.php/apps/files_external/globalstorages",
  "scriptName": "/nextcloud/index.php",
  "message": "Required authorization header missing",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0",
  "version": "34.0.1.2",
  "exception": {
    "Exception": "OC\\AppFramework\\Middleware\\Security\\Exceptions\\NotConfirmedException",
    "Message": "Required authorization header missing",
    "Code": 403,
    "Trace": [
      {
        "file": "/path/to/nextcloud/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php",
        "line": 73,
        "function": "beforeController",
        "class": "OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware",
        "type": "->"
      },
      {
        "file": "/path/to/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 70,
        "function": "beforeController",
        "class": "OC\\AppFramework\\Middleware\\MiddlewareDispatcher",
        "type": "->"
      },
      {
        "file": "/path/to/nextcloud/lib/private/AppFramework/App.php",
        "line": 137,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/path/to/nextcloud/lib/private/Route/Router.php",
        "line": 324,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::"
      },
      {
        "file": "/path/to/nextcloud/lib/base.php",
        "line": 1159,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->"
      },
      {
        "file": "/path/to/nextcloud/index.php",
        "line": 25,
        "function": "handleRequest",
        "class": "OC",
        "type": "::"
      }
    ],
    "File": "/path/to/nextcloud/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php",
    "Line": 83,
    "message": "Required authorization header missing",
    "exception": "{\"class\":\"OC\\AppFramework\\Middleware\\Security\\Exceptions\\NotConfirmedException\",\"message\":\"Required authorization header missing\",\"code\":403,\"file\":\"/path/to/nextcloud/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php:83\",\"trace\":\"#0 /path/to/nextcloud/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php(73): OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware->beforeController()\\n#1 /path/to/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(70): OC\\AppFramework\\Middleware\\MiddlewareDispatcher->beforeController()\\n#2 /path/to/nextcloud/lib/private/AppFramework/App.php(137): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#3 /path/to/nextcloud/lib/private/Route/Router.php(324): OC\\AppFramework\\App::main()\\n#4 /path/to/nextcloud/lib/base.php(1159): OC\\Route\\Router->match()\\n#5 /path/to/nextcloud/index.php(25): OC::handleRequest()\\n#6 {main}\"}",
    "CustomMessage": "Required authorization header missing"
  },
  "id": "6a5f474cb2fdf"
}

Additional info

I anonymized some of the logs above, that had the actual path of the installation and the actual URL of the Nextcloud.

[SystemKeeper]

Can you double check that mod_rewrite is enabled on both instances? a2enmod rewrite and then restart apache.

[Choppel]

This solved it. Our documentation had a flaw and this important part was missing. Thank you very much.

It would be nice nonetheless if a warning would be shown in the administration panel if mod_rewrite is missing. The documentation states that it is necessary (https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html) but the instance didn't warn about it.