[fput]

• Partially resolves: Make login flow v2 more phishing proof #26944

Summary

After analyzing phishing risks in the current login flow v2, I came up with the following improvements to mitigate the phishing risks somewhat, particularly from remote attackers (i.e., attackers with different IPs):

• Show the requesting app’s IP address and display it alongside the browser IP, request age, and user agent. Indicate that the user agent is self-reported. Add help popups for further information, but don't overload the user by default.
• Show a prominent warning when IPs differ and require an additional review step.
• Redesign the browser approval screens with clearer context, an account card with avatar, and explicit Decline and Grant actions.
• Make declining invalidate the pending request.

These changes preserve existing client APIs and legacy login flows.

Before

And then after logging in:

After

Clicking "Continue" will show the login form. After logging in:

If the IP addresses of the client and the browser differ, a warning is shown:

Steps to test my changes:

# Repository root, using Node 24
npm ci
npm --prefix build/frontend run build

# Inside the PHP environment, as the web-server user
php occ migrations:migrate core

In a nextcloud client (I tested with the macOS desktop client) try to add a new account and insert the URL of your instance (e.g. http://nextcloud.local). Then observe the redesigned login flow.

To test what happens when the IP address does not match, you can do something like this to fake the IP (using the dev docker setup):

# create a login request
curl -sS -X POST \
  -A 'IP mismatch preview' \
  http://nextcloud.local/index.php/login/v2 |
  python3 -c 'import json,sys; print(json.load(sys.stdin)["login"])'

# update the IP of the client in the DB so that there is a mismatch
docker exec --user www-data master-nextcloud-1 php -r '
require_once "lib/base.php";
$query = \OCP\Server::get(\OCP\IDBConnection::class)->getQueryBuilder();
$query->update("login_flow_v2")
    ->set("client_ip", $query->createNamedParameter("203.0.113.42"))
    ->where($query->expr()->eq("client_name", $query->createNamedParameter("IP mismatch preview")))
    ->andWhere($query->expr()->isNull("app_password"))
    ->executeStatement();'

# now go to the URL the first command returned and observe the warning in the login flow

Limitations

The IP comparison requires correctly configured proxies/forwarding in the nextcloud server to prevent IP spoofing.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI: I used Codex for implementing and iterating over the changes after I came up with the redesign ideas.