Unable submit and send form, when the form is password protected

[jardoman]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. Create form
2. By sharing the form, in link settings, protect the form with password

Expected behaviour

When somebody want to fill the form, he need to put access password. After submitting corect password, user could fill up the form and submit it.

Actual behaviour

When user click on the submit button of the form, shows up in red "Password required". And form can't be send.

Server configuration

Web server: Apache 2.4.66

Database: PostgreSQL 17.9

PHP version: 8.4.16

Nextcloud version: 33.0.3

** OS:** Debian 13

List of activated apps

Enabled:

• activity: 6.0.0
• bruteforcesettings: 6.0.0
• calendar: 6.2.4
• circles: 33.0.0
• cloud_federation_api: 1.17.0
• comments: 1.23.0
• contacts: 8.4.5
• contactsinteraction: 1.14.1
• dashboard: 7.13.0
• dav: 1.36.0
• federatedfilesharing: 1.23.0
• federation: 1.23.0
• files: 2.5.0
• files_downloadlimit: 5.1.0
• files_external: 1.25.1
• files_pdfviewer: 6.0.0
• files_reminders: 1.6.0
• files_sharing: 1.25.2
• files_trashbin: 1.23.0
• files_versions: 1.26.0
• firstrunwizard: 6.0.0
• flow_notifications: 4.0.0
• forms: 5.2.7
• formvox: 1.2.0
• guests: 4.7.0
• logreader: 6.0.0
• lookup_server_connector: 1.21.0
• mail: 5.7.14
• nextcloud_announcements: 5.0.0
• notes: 5.0.0
• notifications: 6.0.0
• notify_push: 1.3.1
• oauth2: 1.21.0
• otpmanager: 1.1.5
• password_policy: 5.0.0
• passwords: 2026.5.20
• photos: 6.0.0
• privacy: 5.0.0
• profile: 1.2.0
• provisioning_api: 1.23.0
• recommendations: 6.0.0
• related_resources: 4.0.0
• richdocuments: 10.1.3
• serverinfo: 5.0.0
• settings: 1.16.0
• sharebymail: 1.23.0
• spreed: 23.0.4
• support: 5.0.0
• survey_client: 5.0.0
• suspicious_login: 11.0.0
• systemtags: 1.23.0
• text: 7.0.1
• theming: 2.8.0
• twofactor_backupcodes: 1.22.0
• twofactor_nextcloud_notification: 7.0.0
• twofactor_totp: 15.0.0
• updatenotification: 1.23.0
• user_ldap: 1.24.0
• user_status: 1.13.0
• viewer: 6.0.0
• weather_status: 1.13.0
• webhook_listeners: 1.5.0
• workflowengine: 2.15.0
  Disabled:
• admin_audit: 1.23.0
• app_api: 33.0.0 (installed 32.0.0)
• encryption: 2.21.0
• testing: 1.23.0

Nextcloud configuration

{ "system": { "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "10.20.18.7", "127.0.0.1" ], "trusted_proxies": "***REMOVED SENSITIVE VALUE***", "forwarded-for-headers": [ "X-Forwarded-For", "HTTP_X_FORWARDED_FOR" ], "overwriteprotocol": "https", "overwrite.cli.url": "https:\/\/10.20.18.7\/", "htaccess.RewriteBase": "\/", "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "pgsql", "version": "33.0.3.2", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "filelocking.enabled": true, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "smtp", "mail_sendmailmode": "smtp", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "587", "mail_smtpauth": true, "mail_smtpname": "***REMOVED SENSITIVE VALUE***", "mail_smtppassword": "***REMOVED SENSITIVE VALUE***", "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory", "maintenance": false, "maintenance_window_start": 1, "default_phone_region": "SK", "memcache.local": "\\OC\\Memcache\\APCu", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 6379, "dbindex": 0 }, "debug": false, "enable_previews": false, "theme": "", "loglevel": 0, "log_rotate_size": 104857600, "log_type": "file", "config_preset": 7 } }

Browser

Browser name: Firefox 150/Chrome 147.0.7727.138/Safari 26/ Edge 147.0.3912.98

Operating system: Windows 10 64bit/iOS 26/…

Browser log

a) The javascript console log:
Error with Feature-Policy header: Some features are specified in both Feature-Policy and Permissions-Policy header: camera, fullscreen, geolocation, microphone, payment. Values defined in Permissions-Policy header will be used.Understand this warning
Error with Permissions-Policy header: Invalid allowlist item for feature payment. Allowlist item must be *, self, or quoted url.Understand this warning
formvox-public.js?v=18eb54d9-0:2 [ERROR] @nextcloud/vue: The @nextcloud/vue library was used without setting / replacing the appVersion. {app: '@nextcloud/vue', level: 0}
log @ formvox-public.js?v=18eb54d9-0:2
error @ formvox-public.js?v=18eb54d9-0:2
(anonymous) @ formvox-public.js?v=18eb54d9-0:2
(anonymous) @ formvox-public.js?v=18eb54d9-0:2
(anonymous) @ formvox-public.js?v=18eb54d9-0:2Understand this error
session-heartbeat.ts:80 [INFO] core: session heartbeat polling started {app: 'core', level: 0}
4didpMLouwzuADpn2qvOofBFYFRSYG0gd:1 Uncaught (in promise) Error: A listener indicated an asynchronous response by returning true, but the message channel closed before a response was receivedUnderstand this error
formvox-public.js?v=18eb54d9-0:2 POST https://10.20.18.7/apps/formvox/public/75908/didpMLouwzuADpn2qvOofBFYFRSYG0gd/submit 401 (Unauthorized)
(anonymous) @ formvox-public.js?v=18eb54d9-0:2
xhr @ formvox-public.js?v=18eb54d9-0:2
Bn @ formvox-public.js?v=18eb54d9-0:2
_request @ formvox-public.js?v=18eb54d9-0:2
request @ formvox-public.js?v=18eb54d9-0:2
(anonymous) @ formvox-public.js?v=18eb54d9-0:2
toString @ formvox-public.js?v=18eb54d9-0:2
submit @ formvox-public.js?v=18eb54d9-0:2
await in submit
(anonymous) @ formvox-public.js?v=18eb54d9-0:2
n.3751.n..n. @ formvox-public.js?v=18eb54d9-0:2
i @ formvox-public.js?v=18eb54d9-0:2
o @ formvox-public.js?v=18eb54d9-0:2
n @ formvox-public.js?v=18eb54d9-0:2Understand this error

[Rikdekker]

Fixed in v1.2.1.