Lots of 403-errors (Forbidden) for push-URLs

[neufeind]

In the logs I see a flood of 403-errors, all related to a push-URL.
/apps/text/session/.../push

This happens from time to time with like 10 or 20 requests all ending in 403 in the same second.
They all had the same ID (document-ID? session-ID?) in the second last part of the URL (before /push).

Is there a way to avoid such errors and especially those floods? What could be a reason for so many all at once?

[0x46616c6b]

I can add a data point + likely root cause here.

Environment: Nextcloud Hub 26 Spring (34.0.3), PHP 8.4.24, Text app 8.0.0.

Trigger: Browser tab with a Text document left open for a long time (hours). In the meantime the Nextcloud session expires — in my case auth is OIDC-backed, so the underlying token/session is gone server-side. The tab keeps polling POST /apps/text/session/{id}/push every few seconds, and every single one comes back 403 since there's no valid session anymore. The frontend never seems to catch that 403 and stop — it just keeps retrying indefinitely (in my log: 6 requests in ~20s, then continuing).

Consequence: On setups with brute-force protection in front of Nextcloud (I'm running CrowdSec), this repeated POST + 403 on the same path gets flagged as a bruteforce pattern and the client IP gets auto-banned — locking out a legitimate (if stale) client. CrowdSec alert excerpt:

Reason       : LePresidente/http-generic-403-bf
Scope:Value  : Ip:REDACTED
Events Count : 7
method: POST, status: 403, target_uri: /apps/text/session/9888970/push

So this isn't only "log noise" — depending on the reverse-proxy/WAF setup, it can actively lock users out.

Suggested fix: have the session-push polling catch 401/403, stop the polling interval, and trigger re-authentication (redirect to login — for OIDC setups, to the identity provider) instead of retrying the same request forever. Related prior fixes (#3901/#3903, #4080, #4824) handled the "session closed" case but not "auth session expired mid-poll".