Creating a public link fails with 403 when the server enforces link passwords (app never asks for a password) #17846

⚠️ Before posting ⚠️

• This is a bug, not a question or an enhancement.
• I've searched for similar issues and didn't find a duplicate.
• I've written a clear and descriptive title for this issue, not just "Bug" or "Crash".
• I agree to follow Nextcloud's Code of Conduct.

Steps to reproduce

1. On the server, enable Enforce password protection for public links (shareapi_enforce_links_password = yes).
   Optionally enable Enforce expiration date (7 days)
2. In the Android app, open the sharing screen of any file and create a new public link

Expected behaviour

The capabilities say password.enforced: true, so the app should ask for a password, like the web UI does, and send it with the create request.

Actual behaviour

The app does not ask for a password. It sends POST /ocs/v2.php/apps/files_sharing/api/v1/shares without a password parameter, and the server rejects the request with 403.
Each retry fails the same way, so no link is ever created.
From the app it looks like nothing is happening when clicking repeatedly on share.
BUT Creating the link from the web UI or PWA on the same account works.

Android version

17

Device brand and model

Pixel 9XL Pro

Stock or custom OS?

Stock

Nextcloud android app version

Nextcloud-android 35.0.1

Nextcloud server version

Nextcloud 33.0.7 (All-in-One)

Using a reverse proxy?

Yes

Android logs

No logcat attached: the failure is fully visible server-side. The reverse-proxy log and the curl reproduction above show the app's POST without a password parameter and the server's 403 "Passwords are enforced for link and mail shares" response.

Server error logs

Reverse-proxy access log (requests from the app):


2026-10-19T14:40:14Z  GET   /ocs/v2.php/apps/files_sharing/api/v1/shares?path=<file>&reshares=true&subfiles=false  200  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:40:16Z  POST  /ocs/v2.php/apps/files_sharing/api/v1/shares  403  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:40:22Z  POST  /ocs/v2.php/apps/files_sharing/api/v1/shares  403  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:40:23Z  POST  /ocs/v2.php/apps/files_sharing/api/v1/shares  403  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:40:25Z  POST  /ocs/v2.php/apps/files_sharing/api/v1/shares  403  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:40:51Z  GET   /ocs/v2.php/apps/files_sharing/api/v1/shares?path=<file>&reshares=true&subfiles=false  200  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:40:52Z  POST  /ocs/v2.php/apps/files_sharing/api/v1/shares  403  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:40:53Z  POST  /ocs/v2.php/apps/files_sharing/api/v1/shares  403  Mozilla/5.0 (Android) Nextcloud-android/35.0.1
2026-10-19T14:41:05Z  POST  /ocs/v2.php/apps/files_sharing/api/v1/shares  403  Mozilla/5.0 (Android) Nextcloud-android/35.0.1

Additional information

No logcat attached: the failure is fully visible server-side. The reverse-proxy log and the curl reproduction above show the app's POST without a password parameter and the server's 403 "Passwords are enforced for link and mail shares" response.

Server capabilities (/ocs/v1.php/cloud/capabilities -> files_sharing.public):

{
  "enabled": true,
  "password": { "enforced": true, "askForOptionalPassword": false },
  "expire_date": { "enabled": true, "days": 7, "enforced": true },
  "multiple_links": true,
  "expire_date_internal": { "enabled": false },
  "expire_date_remote": { "enabled": false },
  "send_mail": false,
  "upload": false,
  "upload_files_drop": false,
  "custom_tokens": true
}

Server-side reproduction (same account and file, using an app password):
Without a password (matches what the app sends), the request fails:

curl -u user:apppassword -H 'OCS-APIRequest: true' -H 'Accept: application/json' \
    https://<server>/ocs/v2.php/apps/files_sharing/api/v1/shares \
    -d path=/<file> -d shareType=3 -d publicUpload=false
{"ocs":{"meta":{"status":"failure","statuscode":403,"message":"Passwords are enforced for link and mail shares"},"data":[]}}   HTTP 403

The same request with -d password=<password> returns 200 OK and the share is created (permissions 17).
Nextcloud does not log anything for these rejections: the error is raised as a HintException and returned straight to the client.

Related issues:

• Implement "Always ask for a password" on Android for public links #3687: says "Enforce password" worked on Android, so this looks like a regression.
• Prevent enforced password and expiration date removal when editing a share #13186: same area of the app; when editing a share, it doesn't respect the enforced password and expiration date.
• Error message not shown when update share fails #14439: the app shows no error message when a share operation fails, which is probably why this failure is silent.
• Sharing with "password rule" enabled is not working #1089: older report of link sharing failing with password rules enabled.
• Link sharing fails if password enforcement is enabled for public links ios#801: the same bug in the iOS app (link sharing fails when password enforcement is enabled).
• Possibly the same issue reported on the forum: https://help.nextcloud.com/t/unable-to-create-external-shares-via-android-app/238856