[Bug]: InvalidArgumentException: userId cannot be an empty string

[biredel]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Exception logged: "userId cannot be an empty string"

Steps to reproduce

1. reopen yesterdays browser tabs while authenticated from proxy via REMOTE_USER
2. observe logs

Expected behavior

Auth issues should always be handled robustly. Any request should be handled as a request from an authorized user, or not. Never in some internal error state in between.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "version": "31.0.7.1",
        "config_is_read_only": true,
        "connectivity_check_domains": [],
        "check_for_working_wellknown_setup": false,
        "secret": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance_window_start": 21,
        "debug": false,
        "default_phone_region": "DE",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "updatechecker": false,
        "upgrade.disable-web": true,
        "updater.server.url": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "stable",
        "skeletondirectory": "",
        "default_language": "de",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "htaccess.RewriteBase": "\/",
        "allow_local_remote_servers": true,
        "loglevel": 2,
        "log_type": "syslog",
        "syslog_tag": "nextcloud",
        "logfile": "",
        "logdateformat": "Y-m-d H:i:s",
        "logtimezone": "UTC",
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "log_type_audit": "syslog",
        "syslog_tag_audit": "nextcloud",
        "logfile_audit": "",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Memcached",
        "memcache.locking": "\\OC\\Memcache\\Memcached",
        "memcached_servers": [
            [
                "\/run\/nextcloud\/memcached.sock",
                0
            ]
        ],
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "maintenance": false,
        "knowledgebaseenabled": false,
        "enable_previews": true,
        "allow_user_to_change_display_name": false,
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpsecure": "ssl",
        "mail_smtpauth": 1,
        "trashbin_retention_obligation": "14, 60",
        "mail_send_plaintext_only": true,
        "theme": "",
        "has_internet_connection": false
    }
}

List of activated Apps

Enabled:
  - activity: 4.0.0
  - admin_audit: 1.21.0
  - app_api: 5.0.2
  - calendar: 5.3.7
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contactsinteraction: 1.12.0
  - dav: 1.33.0
  - federatedfilesharing: 1.21.0
  - files: 2.3.1
  - files_accesscontrol: 2.0.0
  - files_automatedtagging: 2.0.0
  - files_downloadlimit: 4.0.0
  - files_reminders: 1.4.0
  - files_retention: 2.0.1
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - related_resources: 2.0.0
  - richdocuments: 8.7.3
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - systemtags: 1.21.1
  - tasks: 0.16.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - user_saml: 6.6.0
  - viewer: 4.0.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - bruteforcesettings: 4.0.0 (installed 1.0.3)
  - dashboard: 7.11.0 (installed 7.0.0)
  - encryption: 2.19.0
  - federation: 1.21.0 (installed 1.2.0)
  - files_external: 1.23.0
  - files_pdfviewer: 4.0.0 (installed 2.10.0)
  - nextcloud_announcements: 3.0.0 (installed 1.1)
  - password_policy: 3.0.0 (installed 1.3.0)
  - photos: 4.0.0 (installed 1.0.0)
  - recommendations: 4.0.0 (installed 0.8.0)
  - support: 3.0.0 (installed 1.1.0)
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - updatenotification: 1.21.0 (installed 1.2.0)
  - user_ldap: 1.22.0
  - user_status: 1.11.0 (installed 1.8.1)
  - weather_status: 1.11.0 (installed 1.7.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"***redacted***","level":3,"time":"2025-07-31 06:39:29","remoteAddr":"***redacted***","user":"--","app":"index","method":"GET","url":"/apps/files/?dir=/redacted&fileid=1337","message":"{\"Exception\":\"InvalidArgumentException\",\"Message\":\"userId cannot be an empty string\",\"Code\":0,\"Trace\":[{\"file\":\"/nc/lib/private/Config/UserConfig.php\",\"line\":152,\"function\":\"assertParams\",\"class\":\"OC\\\\Config\\\\UserConfig\",\"type\":\"->\"},{\"file\":\"/nc/lib/private/AllConfig.php\",\"line\":282,\"function\":\"hasKey\",\"class\":\"OC\\\\Config\\\\UserConfig\",\"type\":\"->\"},{\"file\":\"/nc/lib/private/TemplateLayout.php\",\"line\":130,\"function\":\"getUserValue\",\"class\":\"OC\\\\AllConfig\",\"type\":\"->\"},{\"file\":\"/nc/lib/private/legacy/OC_Template.php\",\"line\":120,\"function\":\"__construct\",\"class\":\"OC\\\\TemplateLayout\",\"type\":\"->\"},{\"file\":\"/nc/lib/public/AppFramework/Http/TemplateResponse.php\",\"line\":189,\"function\":\"fetchPage\",\"class\":\"OC_Template\",\"type\":\"->\"},{\"file\":\"/nc/lib/private/AppFramework/Http/Dispatcher.php\",\"line\":159,\"function\":\"render\",\"class\":\"OCP\\\\AppFramework\\\\Http\\\\TemplateResponse\",\"type\":\"->\"},{\"file\":\"/nc/lib/private/AppFramework/App.php\",\"line\":161,\"function\":\"dispatch\",\"class\":\"OC\\\\AppFramework\\\\Http\\\\Dispatcher\",\"type\":\"->\"},{\"file\":\"/nc/lib/private/Route/Router.php\",\"line\":315,\"function\":\"main\",\"class\":\"OC\\\\AppFramework\\\\App\",\"type\":\"::\"},{\"file\":\"/nc/lib/base.php\",\"line\":1040,\"function\":\"match\",\"class\":\"OC\\\\Route\\\\Router\",\"type\":\"->\"},{\"file\":\"/nc/index.php\",\"line\":24,\"function\":\"handleRequest\",\"class\":\"OC\",\"type\":\"::\"}],\"File\":\"/nc/lib/private/Config/UserConfig.php\",\"Line\":1668,\"message\":\"userId cannot be an empty string\",\"exception\":{},\"CustomMessage\":\"userId cannot be an empty string\"}","userAgent":"***redacted***","version":"31.0.7.1"}

Additional info

I do not yet know ways to immediately or reliably trigger this. I have so far only seen it with with memcached enabled, possibly some non-atomic cache operation involving multiple keys?

[mkt1]

I also have the problem with 31.0.7

One of two login attempts go wrong and show the error immediately. With a reload I can continue.

<?php
$CONFIG = array (
  'htaccess.RewriteBase' => '/',
  'apps_paths' => 
  array (
    0 => 
    array (
      'path' => '/var/www/html/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 => 
    array (
      'path' => '/var/www/html/custom_apps',
      'url' => '/custom_apps',
      'writable' => true,
    ),
  ),
  #'memcache.local' => '\\OC\\Memcache\\APCu',
  'memcache.local' => '\\OC\\Memcache\\Redis',
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' => 
  array (
    'host' => 'redis',
    'password' => '***REMOVED SENSITIVE VALUE***',
    'port' => 6379,
  ),
  'overwritehost' => 'nextcloud.my.example.com',
  'overwriteprotocol' => 'https',
  'overwrite.cli.url' => 'https://nextcloud.my.example.com',
  'trusted_proxies' => 
  array (
    0 => '172.18.0.0/16',
  ),
  'upgrade.disable-web' => true,
  'instanceid' => '***REMOVED SENSITIVE VALUE***',
  'passwordsalt' => '***REMOVED SENSITIVE VALUE***',
  'secret' => '***REMOVED SENSITIVE VALUE***',
  'trusted_domains' => 
  array (
    0 => 'nextcloud.my.example.com',
  ),
  'datadirectory' => '/var/www/html/data',
  'dbtype' => 'mysql',
  'version' => '31.0.7.1',
  'dbname' => 'nextcloud',
  'dbhost' => 'mysql',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'nextcloud',
  'dbpassword' => '***REMOVED SENSITIVE VALUE***',
  'installed' => true,
  'forbidden_filename_basenames' => 
  array (
    0 => 'con',
    1 => 'prn',
    2 => 'aux',
    3 => 'nul',
    4 => 'com0',
    5 => 'com1',
    6 => 'com2',
    7 => 'com3',
    8 => 'com4',
    9 => 'com5',
    10 => 'com6',
    11 => 'com7',
    12 => 'com8',
    13 => 'com9',
    14 => 'com¹',
    15 => 'com²',
    16 => 'com³',
    17 => 'lpt0',
    18 => 'lpt1',
    19 => 'lpt2',
    20 => 'lpt3',
    21 => 'lpt4',
    22 => 'lpt5',
    23 => 'lpt6',
    24 => 'lpt7',
    25 => 'lpt8',
    26 => 'lpt9',
    27 => 'lpt¹',
    28 => 'lpt²',
    29 => 'lpt³',
  ),
  'forbidden_filename_characters' => 
  array (
    0 => '<',
    1 => '>',
    2 => ':',
    3 => '"',
    4 => '|',
    5 => '?',
    6 => '*',
    7 => '\\',
    8 => '/',
  ),
  'forbidden_filename_extensions' => 
  array (
    0 => ' ',
    1 => '.',
    2 => '.filepart',
    3 => '.part',
  ),
  'defaultapp' => 'files',
  'default_language' => 'de',

  // Session Fix für Docker + Traefik
  'session_save_handler' => 'redis',
  'session_save_path' => 'tcp://redis:6379',
  'session_keepalive' => true,
  'session.gc_maxlifetime' => 86400,
  'session.cookie_lifetime' => 86400,
  'session.cookie_secure' => true,
  'session.cookie_httponly' => true,
  'session.cookie_samesite' => 'Lax',
);