From f4620d5434f2f3339dec696ed68efec6a453ed24 Mon Sep 17 00:00:00 2001
From: Robin Appelman <robin@icewind.nl>
Date: Mon, 4 May 2026 18:00:52 +0200
Subject: [PATCH] fix: don't tell the remote their token is lower

Signed-off-by: Robin Appelman <robin@icewind.nl>
---
 apps/federation/lib/Controller/OCSAuthAPIController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/federation/lib/Controller/OCSAuthAPIController.php b/apps/federation/lib/Controller/OCSAuthAPIController.php
index dd9b94d00279e..eec134b775c4c 100644
--- a/apps/federation/lib/Controller/OCSAuthAPIController.php
+++ b/apps/federation/lib/Controller/OCSAuthAPIController.php
@@ -154,7 +154,7 @@ public function requestSharedSecret($url, $token) {
 				'remote server (' . $url . ') presented lower token. We will initiate the exchange of the shared secret.',
 				['app' => 'federation']
 			);
-			throw new OCSForbiddenException();
+			return new DataResponse();
 		}
 
 		$this->jobList->add(