2.6 intermittent login failures

Support
1

Hi. I’m self hosting, with PG backend, on ubuntu 24.04 behind nginx proxy. (Not in docker.) I upgraded to 2.3 when it came out and was running it until yesterday when I upgraded to 2.6. I assume my login issues are with my upgrade process, described below.

SEQUENCE OF EVENTS:

  1. I replaced 2.3 executable with 2.6 and re-started the systemd service. When logging in, after entering username/password, I got a page with the vikunja icon and a circular spinner that never went away. However, “view source” showed that the page appeared to have loaded normally and there were no errors in the vikunja log. Using curl -i ... shows an instantaneous and apparently correct response. All the link hrefs in the response are correct and functional and the full HTML document is present.
  2. I thought maybe I needed to pass through each major revision, so I went back to 2.3 and everything worked correctly. Then I upgraded to 2.4 successfully, 2.5 successfully and then 2.6 upgrade was also successful. I’ve been using it without an issue for ~24 hours until I activated TFA using TOTP.
  3. After enrolling with 2FA as TOTP, I logged in successfully and all was fine for an hour or two. Then in normal usage - not a login attempt - I suddenly got the full screen page with the vikunja icon and a circular spinner that never went away. This happened for no reason that I can remember. (Perhaps a security timed out or some such???)

TROUBLESHOOTING:

  • I’ve tried deleting cookies on my browser: no change (eternal spinner on login attempt)
  • I restarted vikunja & nginx: no change (eternal spinner on login attempt)
  • I tried a different browser (from a chromium derivative to FF): no change (eternal spinner on login attempt)
  • I do now see these two entries recurring in the log file which I had not noticed before:

time=2026-09-03T13:50:17.972-07:00 level=ERROR msg=“WebSocket: upgrade failed: failed to accept WebSocket connection: WebSocket protocol violation: handshake request must be at least HTTP/1.1: "HTTP/1.0"”

time=2026-09-03T13:51:40.523-07:00 level=WARN msg=“CalDAV basic auth rejected for user 2: TOTP is enabled, a CalDAV token is required”

I’m not sure what either of the above is trying to tell me; the first sounds like a client error using HTTP 1.0, but this is the web client of Vikunja server itself…

The second line befuddles me because CalDAV is not involved so far as I know???

I have absolutely no idea how to proceed, other than perhaps downgrade to 2.3 again, but of course I’m eager to retain the 2.6 features :slight_smile: .

SPECIFIC QUESTION:

  • Do I need to step through each major version when upgrading? I haven’t seen that it in the docs anywhere…

Any help/direction very much appreciated…

Thanks in advance!!

2

Hey :waving_hand:

It should not be needed to pass through every version to the latest, only migrating backwards is not supported.

The error sounds like it could be an issue with your nginx. Can you share your config?

The CalDAV error is expected, you need to use a token with accounts that have TOTP enabled because there’s no way to pass a TOTP token via CalDAV auth.

3

The error sounds like it could be an issue with your nginx. Can you share your config?

I’ll double check nginx settings when I get home this evening and send along config info if the problem doesn’t jump up at me and make me feel stupid :sweat_smile:.

The CalDAV error is expected, you need to use a token with accounts that have TOTP enabled because there’s no way to pass a TOTP token via CalDAV auth.

Ah, that makes sense. Thank you very much for both insights, Sir Kolaente!!!

Best,

Tengam

4

Sorry for long delay. Koalente nailed it by flagging nginx as culprit.

It was not as simple as a stupid vikunja config file, but it was indeed stupid (!) and definitely nginx config. (Having to do with DNS issues around multiple hostnames, etc.)

Thanks as always for awesome support of an awesome product!