[Bug]: Ephemeral webhook authentication tokens pile up

[StefanRichterHuber]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

I use the webhook_listeners app. An external application registers a webhook call with the parameter tokenNeeded set to {"user_ids": [], "user_roles": ["trigger"]}. This works as expected. With each webhook invocation I get some credentials to perform actions on behalf of the user.

However, when looking in the Nextcloud User Security UI or use occ user:auth-tokens:list [user] almost 1000 tokens of type Ephemeral webhook authentication (on my German system German: "Kurzlebige Webhook-Authentifizierung") are present for each user. I assume the output is just capped at 1000, so there are potentially more.

Steps to reproduce

1. Register a webhook with parameter tokenNeeded set to {"user_ids": [], "user_roles": ["trigger"]}
2. Trigger the events for the webhook at least once
3. Use occ user:auth-tokens:list [user]: One should see tokens with name Ephemeral webhook authentication
4. Wait some time (I think timeout for tokens is an hour, so 1.5h)
5. Check again with occ user:auth-tokens:list [user]. Tokens are still present.

Expected behavior

Tokens are automatically cleaned after some configurable time.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "serverid": 1,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": true,
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "192.168.137.10:8085",
            "localhost:8085"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.4.1",
        "overwrite.cli.url": "https:\/\/nextcloud.[example].de",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "loglevel": 2,
        "allow_local_remote_servers": true,
        "theme": "",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwritehost": "nextcloud.[example].de",
        "overwriteprotocol": "https",
        "app_install_overwrite": [
            "bookmarks_fulltextsearch",
            "oidc_login",
            "fulltextsearch",
            "webhooks",
            "files_fulltextsearch_tesseract",
            "metadata",
            "fulltextsearch_elasticsearch",
            "tasks",
            "files_fulltextsearch"
        ],
        "mysql.utf8mb4": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "default_phone_region": "DE",
        "maintenance_window_start": "1",
        "auth": {
            "bruteforce": {
                "protection_enabled": true,
                "delay": 15,
                "max_attempts": 5,
                "time_window": 30
            }
        },
        "user_oidc": {
            "oidc_provider_bearer_validation": true
        },
        "upgrade.disable-web": true
    }

List of activated Apps

- activity: 7.0.0
  - app_api: 34.0.0
  - appointments: 2.7.4
  - appstore: 1.0.0
  - audioplayer: 3.9.0
  - bookmarks: 16.2.7
  - bruteforcesettings: 7.0.0
  - calendar: 6.6.1
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contacts: 8.9.0
  - contactsinteraction: 1.15.0
  - dashboard: 7.14.0
  - dav: 1.40.0
  - deck: 1.18.5
  - federatedfilesharing: 1.24.0
  - files: 2.6.0
  - files_automatedtagging: 5.0.0
  - files_downloadlimit: 5.2.0
  - files_external: 1.26.0
  - files_fulltextsearch: 34.0.1
  - files_fulltextsearch_tesseract: 32.0.0
  - files_lock: 34.0.1
  - files_pdfviewer: 7.0.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - flow_notifications: 5.0.0
  - fulltextsearch: 34.0.2
  - fulltextsearch_elasticsearch: 34.0.2
  - gpoddersync: 3.18.0
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - nextcloud_announcements: 6.0.0
  - nextpod: 0.7.12
  - notes: 6.1.0
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - ocs_api_viewer: 1.0.13
  - office: 1.0.0
  - oidc: 2.3.1
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - previewgenerator: 5.15.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recognize: 12.0.2
  - related_resources: 5.0.0-dev.0
  - repod: 4.3.2
  - richdocuments: 11.1.1
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - suspicious_login: 12.0.0-dev.0
  - systemtags: 1.24.0
  - tables: 2.3.1
  - tasks: 0.18.1
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_oidc: 8.11.0
  - viewer: 7.0.0-dev.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0

Nextcloud Signing status

Nextcloud Logs

Additional info

No response