Remove login token mechanism

[ChristophWurst]

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.

Before Nextcloud (or it's predecessor) tracked sessions and app passwords in the database, remember me login existed. Because session information is typically lost after 20minutes, there is a unique token stored as cookie and database value. The browser uses that cookie as proof that a previous session existed.

Since 2016 Nextcloud has auth tokens for web sessions and app passwords. When a PHP session expires, the session cookie sent could still be used to look up the authtoken table row, regardless of the vanished PHP session.
That means there are currently two mechanisms used in parallel.

Describe the solution you'd like

Drop the login token mechanism and fully rely on app tokens.

Describe alternatives you've considered

N/a

Additional context

• Pluggable auth owncloud/core#24189

[ChristophWurst]

One thing the old login tokens mechanism can do, which the session tokens currently can't is prevent replay attacks. That's because login tokens are used only once. No two or more requests can use the same token to start a new session.