Skip to content

[BUG] WebDAV sync/backup conflicts with browser cookies #1297

Closed

Description

@jenda69

Problem Description

I'm trying to backup or sync settings to my Nextcloud server but I'm having issues.
The thing is, I'm logged into my personal Nextcloud account in the browser and I want ScriptCat to sync to a different account. But the sync or backup fails with 401 Unauthorized (I see that in DevTools).
If I log out of my personal account on the Nextcloud webpage and run backup again, it succeeds. And when I return to the Nextcloud webpage I'm logged in as the "sync" account now.
The extension and the normal browser share cookies and this is the results of that (I can see all the cookies in the request in DevTools).

Similar, albeit not as obvious, thing happens if I'm logged into my personal account on the web and try to backup/sync into the same personal account using "app password" - backup fails too, until I log out of the web, run backup again and it succeeds. Back on the web and I'm logged in! (bypassing 2FA but I guess that's the point of app password in the first place; but the cookies shouldn't transfer from the extension to the normal browser).

I tried doing similar thing in Violentmonkey (logged into my personal account, backing up to the "sync" account) and it didn't have the problem so I think separating cookies should be possible. (I checked DevTools too and the request in Violentmonkey does have a different cookies, it also sends this using background page unlike ScriptCat which does it in options.html)

Reproduction Steps

  1. Log into your Nextcloud account on the web
  2. Use a different Nextcloud account in the ScriptCat backup or sync.
  3. Start backup
  4. Fail

ScriptCat Version

1.2.6

Operating System and Browser Information

Windows 10, Vivaldi 7.8.3925.81

Additional Information (Optional)

No response

Activity

  1. added theissue type on Mar 18, 2026
  2. CodFrm commented on Mar 22, 2026

    @CodFrm
    Member

    Hi @jenda69,

    This should be fixed in #1308. The root cause is that WebDAV requests made from the options page automatically include browser cookies for the target domain, which conflicts with the credentials configured in ScriptCat.

    The fix forces credentials: "omit" on all WebDAV fetch requests via the webdav library's patcher API, so only the username/password (Authorization header) is used for authentication.

    I don't have a Nextcloud environment to test with — could you help verify the fix? You can grab the build artifact from the CI Action on the PR. https://github.com/scriptscat/scriptcat/actions/runs/23394754087

    Thanks for the detailed bug report!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions