[Bug]: PHP Warning: Cannot modify header information - headers already sent in sabre/http Sapi.php during PROPFIND requests on .nomedia

[alex-1987]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Since enabling the notify_push (High Performance Backend) app and/or updating from 34.0.1 to 34.0.2 and optimizing client interactions, i observe intermittent PHP warnings in the Nextcloud log during WebDAV PROPFIND requests (specifically targeting .nomedia files, often routed through proxies/Cloudflare).

While synchronization and functionality are completely unaffected, these warnings clutter the logs.

[PHP] Warnung: Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68
PROPFIND /public.php/webdav/blaaa/.nomemories
von 172.xx.xxx.247 von -- um 26.07.2026, 21:50:53

Steps to reproduce

1.Enable notify_push (High Performance Backend) with Redis and a proper reverse proxy chain.

2.Have clients (or sync tools) perform background WebDAV queries/PROPFIND requests (e.g., checking for .nomedia files).

3.Check the Nextcloud log.

Expected behavior

WebDAV requests should complete without triggering PHP header warnings.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

after update from 34.0.1 to 34.0.2

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

root@LXC-Nextcloud:~# occ config:list system
{
    "system": {
        "serverid": 1,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "10.0.10.12",
            "cloud2.underwater-way.com"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.2.1",
        "overwrite.cli.url": "https:\/\/cloud2.underwater-way.com",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "overwritehost": "cloud2.underwater-way.com",
        "activity_expire_days": 14,
        "allow_local_remote_servers": true,
        "auth.bruteforce.protection.enabled": true,
        "forbidden_filenames": [
            ".htaccess",
            "Thumbs.db",
            "thumbs.db"
        ],
        "cron_log": true,
        "default_phone_region": "DE",
        "enable_previews": true,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\Movie",
            "OC\\Preview\\PDF",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\Movie",
            "OC\\Preview\\MKV",
            "OC\\Preview\\MP4",
            "OC\\Preview\\AVI"
        ],
        "filesystem_check_changes": 0,
        "filelocking.enabled": "true",
        "htaccess.RewriteBase": "\/",
        "integrity.check.disabled": false,
        "knowledgebaseenabled": false,
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "debug": false,
        "loglevel": 3,
        "logtimezone": "Europe\/Berlin",
        "remember_login_cookie_lifetime": 7200,
        "session_lifetime": 7200,
        "session_keepalive": true,
        "auto_logout": true,
        "minimum.supported.desktop.version": "4.0.1",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "overwriteprotocol": "https",
        "preview_max_x": 1024,
        "preview_max_y": 768,
        "preview_max_scale_factor": 1,
        "profile.enabled": false,
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "password": "***REMOVED SENSITIVE VALUE***",
            "timeout": 0.5,
            "dbindex": 1
        },
        "quota_include_external_storage": false,
        "share_folder": "\/Freigaben",
        "skeletondirectory": "",
        "trashbin_retention_obligation": "auto, 7",
        "maintenance_window_start": 1,
        "maintenance": false,
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-amd64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "onlyoffice": {
            "jwt_secret": "***REMOVED SENSITIVE VALUE***",
            "jwt_header": "EUOFFICE"
        },
        "updater.secret": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "versions_retention_obligation": "auto, 365",
        "simpleSignUpLink.shown": false,
        "upgrade.disable-web": false,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "log_rotate_size": "0"
    }
}

List of activated Apps

Enabled:
  - activity: 7.0.0
  - admin_audit: 1.24.0
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.1
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contacts: 8.7.4
  - contactsinteraction: 1.15.0
  - dashboard: 7.14.0
  - dav: 1.39.0
  - eurooffice: 11.0.1
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_downloadlimit: 5.2.0
  - files_lock: 34.0.1
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - gpoddersync: 3.17.0
  - integration_paperless: 1.0.13
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - memories: 8.1.0
  - nextcloud_announcements: 6.0.0
  - notes: 6.0.1
  - notifications: 7.0.0-dev.1
  - notify_push: 1.3.5
  - oauth2: 1.22.0
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - previewgenerator: 5.14.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recommendations: 7.0.0
  - related_resources: 5.0.0-dev.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - support: 6.0.0
  - survey_client: 6.0.0-dev.0
  - suspicious_login: 12.0.0-dev.0
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_oidc: 8.10.1
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - app_api: 34.0.0 (installed 32.0.0)
  - encryption: 2.22.0
  - files_external: 1.26.0
  - office: 1.0.0 (installed 1.0.0)
  - systemtags: 1.24.0 (installed 1.18.0)
  - twofactor_nextcloud_notification: 8.0.0
  - user_ldap: 1.25.0
  - weather_status: 1.14.0 (installed 1.10.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"nlGjfl72tqHq0f4bwvQ1","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.06/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"XV0eNYmAsVSdXXClYhPw","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#64","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"XV0eNYmAsVSdXXClYhPw","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"XV0eNYmAsVSdXXClYhPw","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"XV0eNYmAsVSdXXClYhPw","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"XV0eNYmAsVSdXXClYhPw","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"WZgNfbKZkmXreBSG04jl","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#64","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"WZgNfbKZkmXreBSG04jl","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"WZgNfbKZkmXreBSG04jl","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"WZgNfbKZkmXreBSG04jl","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"WZgNfbKZkmXreBSG04jl","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.07/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"jkN5w8KLi0R5vNW1SkFJ","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#64","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"jkN5w8KLi0R5vNW1SkFJ","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"jkN5w8KLi0R5vNW1SkFJ","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"jkN5w8KLi0R5vNW1SkFJ","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"jkN5w8KLi0R5vNW1SkFJ","level":2,"time":"2026-07-26T21:50:52+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"gByq8hfLji4Z2cI0ff5O","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#64","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"gByq8hfLji4Z2cI0ff5O","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"gByq8hfLji4Z2cI0ff5O","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"gByq8hfLji4Z2cI0ff5O","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"gByq8hfLji4Z2cI0ff5O","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Michi%20Haushofer/2025.12.08/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"llygTC8Fqghb3Yg2XOtE","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#64","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"llygTC8Fqghb3Yg2XOtE","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"llygTC8Fqghb3Yg2XOtE","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"llygTC8Fqghb3Yg2XOtE","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"llygTC8Fqghb3Yg2XOtE","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomedia","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"AJJqLSWjU5w5IWSgvsSO","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#64","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"AJJqLSWjU5w5IWSgvsSO","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"AJJqLSWjU5w5IWSgvsSO","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"AJJqLSWjU5w5IWSgvsSO","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}
{"reqId":"AJJqLSWjU5w5IWSgvsSO","level":2,"time":"2026-07-26T21:50:53+02:00","remoteAddr":"172.71.141.247","user":"--","app":"PHP","method":"PROPFIND","url":"/public.php/webdav/%40Tauchen/2025/Peter2025/.nomemories","scriptName":"/public.php","message":"Cannot modify header information - headers already sent by (output started at /var/www/nextcloud/3rdparty/sabre/http/lib/Message.php:117) at /var/www/nextcloud/3rdparty/sabre/http/lib/Sapi.php#68","userAgent":"sabre-dav/4.6.0 (http://sabre.io/)","version":"34.0.2.1","data":{"app":"PHP"}}

Additional info

• i made a update from/to 34.0.1/34.0.2

• i installed and configured notify_push

• and made following changes in the config:

occ config:system:set remember_login_cookie_lifetime --value="1800"
occ config:system:set log_rotate_size --value="104857600"
occ config:system:set trashbin_retention_obligation --value="auto, 7"
occ config:system:set versions_retention_obligation --value="auto, 365"
occ config:system:set simpleSignUpLink.shown --type=bool --value=false
occ config:system:set upgrade.disable-web --type=bool --value=true
occ config:app:set text workspace_available --value=0
occ config:system:set loglevel --value="2"
occ config:app:set settings profile_enabled_by_default --value="0"
occ app:enable admin_audit
occ config:app:set admin_audit logfile --value="/var/log/nextcloud/audit.log"
occ config:system:set log.condition apps 0 --value admin_audit

• and

`'remember_login_cookie_lifetime' => 7200,
'session_lifetime' => 7200,
'session_keepalive' => true,
'auto_logout' => true,`

• and in /etc/php/8.4/fpm/php.ini
  session.gc_maxlifetime = 7200

• and in /etc/sysctl.d/100-nextcloud.conf

# Schutz gegen IP-Spoofing (IPv4 und IPv6)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Schutz gegen TCP-SYN-Flooding (IPv4)
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_synack_retries = 2
net.core.somaxconn = 1024

# ICMP Echo Ignore Broadcasts (IPv4)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# ICMP Redirects deaktivieren (IPv4 und IPv6)
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Sourcen-Routing deaktivieren (IPv4 und IPv6)
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# TCP-Timestamps deaktivieren (IPv4)
net.ipv4.tcp_timestamps = 0

# Loggen von Martian-Paketen (IPv4 und IPv6)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv6.conf.all.log_martians = 1
net.ipv6.conf.default.log_martians = 1

# Maximale Anzahl von halb offenen Verbindungen (IPv4)
net.ipv4.tcp_max_syn_backlog = 4096

# Netzwerkspeichergrößen erhöhen (IPv4 und IPv6)
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 262144
net.core.wmem_default = 262144
net.core.optmem_max = 40960

# Maximale Anzahl von Verbindungstrackings erhöhen (IPv4 und IPv6)
net.netfilter.nf_conntrack_max = 262144
net.netfilter.nf_conntrack_tcp_timeout_established = 1800

# Maximaler Backlog für Netzwerkgeräte erhöhen (IPv4 und IPv6)
net.core.netdev_max_backlog = 5000

# TCP-Verbindungseinstellungen optimieren (IPv4)
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_probes = 5
net.ipv4.tcp_keepalive_intvl = 15

# Datei-Deskriptor-Limits erhöhen
fs.file-max = 2097152

# TCP-Warteschlangen (Read/Write Queues) erhöhen (IPv4)
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# TCP-Window-Scaling aktivieren (IPv4)
net.ipv4.tcp_window_scaling = 1

# TCP-Memory-Management optimieren (IPv4)
net.ipv4.tcp_mem = 50576 64768 98152

# Reverse Path Filtering aktivieren (IPv4 und IPv6)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv6.conf.all.rp_filter = 1
net.ipv6.conf.default.rp_filter = 1

# TCP Fast Open aktivieren (optional, IPv4)
net.ipv4.tcp_fastopen = 3

# ARP-Caching verbessern (IPv4)
net.ipv4.neigh.default.gc_thresh1 = 1024
net.ipv4.neigh.default.gc_thresh2 = 2048
net.ipv4.neigh.default.gc_thresh3 = 4096

[iog-cu]

AI-generated comment. I'm Claude (Sonnet 5, Anthropic), acting as a coding assistant for a developer debugging a client crash against Nextcloud's WebDAV endpoint. Posted with the account holder's explicit review and approval — the account holder confirms this is accurate and consented to AI authorship disclosure.

Root cause: Server::$streamMultiStatus = true (PR #62164 / backport #62224) exposes an unhandled mid-stream exception in Server::start()'s error-recovery path

We independently hit this exact symptom (Cannot modify header information - headers already sent ... in .../sabre/http/lib/Sapi.php) while debugging a WebDAV client (webdav npm package) that crashes parsing the resulting response body. Traced it to a specific, reproducible mechanism — sharing it here since it pinpoints the exact commit and code path, which may help prioritize a fix.

Mechanism

1. apps/dav/lib/Connector/Sabre/ServerFactory.php sets Server::$streamMultiStatus = true unconditionally (added in aa0fde29223 / backported to stable34 in [stable34] perf(dav): Stream PROPFIND output #62224, "perf(dav): Stream PROPFIND output"). Before this change, generateMultiStatus() returned a plain string built in memory; after it, the method returns a closure.
2. Sabre\HTTP\Sapi::sendResponse() detects the callable body (is_callable($body)) and invokes it directly. The closure opens a Sabre\Xml\Writer directly on php://output and calls startDocument() + startElement('{DAV:}multistatus') — this writes the XML prolog and the opening <d:multistatus ...> tag (with all namespace declarations) straight to the response stream, immediately.
3. The closure then iterates a lazy properties iterator (Server::getPropertiesIteratorForPath()) to emit each <d:response> element. If resolving one of those entries throws (in our repro: Sabre\DAV\Exception\NotFound from apps/dav/lib/Connector/Sabre/ObjectTree.php — the ordinary way a PROPFIND on a not-yet-existing path signals 404), the exception fires after the opening tag is already on the wire, mid-iteration, before endElement()/endDocument() ever run.
4. The exception propagates out of the closure, out of Sapi::sendResponse() (no try/catch around the callable invocation), out of invokeMethod(), and is caught by apps/dav/lib/Connector/Sabre/Server::start()'s outer catch (\Throwable $e).
5. That catch block builds a fresh, well-formed <d:error> document via DOMDocument and calls $this->sapi->sendResponse($this->httpResponse) a second time — without ever discarding/cleaning whatever the interrupted first attempt already wrote to php://output. The second header() call in Sapi::sendResponse() is what produces the "headers already sent" warning you're seeing, reported against whatever line in Sapi.php/Message.php the first write happened at.

Net effect: the client receives two concatenated XML documents in one response body — a truncated <d:multistatus ... opening tag (namespace attributes present, no children, no closing tag) immediately followed by a complete, well-formed <d:error>...</d:error> document. Example (paths/hostnames genericized):

<?xml version="1.0"?>
<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns" xmlns:nc="http://nextcloud.org/ns"<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\NotFound</s:exception>
  <s:message>File with name &lt;redacted-path&gt; could not be located</s:message>
</d:error>

This is not well-formed XML (two documents, no closing root element) and will break any client that doesn't happen to bail out before parsing the body.

PHP-version-dependent symptom, same underlying defect

We reproduced this on 34.0.2 under PHP 8.4 and also under PHP 8.5.8 (official nextcloud:34 Docker image). The response body corruption is present and identical in shape on both, but the HTTP status line differs depending on exact timing of when the first (interrupted) attempt's headers get committed relative to output writes:

• On PHP 8.4: the first attempt's header() call commits before the exception fires, so the client sees the wrong status line (207 Multi-Status) with the corrupted body attached.
• On PHP 8.5.8: the first attempt's headers apparently don't commit in time, so the second (corrective) response's header() call succeeds and the client sees the correct status line (404 Not Found), still with a corrupted body attached (documents in reversed order — error doc first, then the truncated multistatus fragment appended after it).

This PHP-version difference happened to mask the crash for our specific client code path (which checks the HTTP status code before attempting to parse the response body, so it never touches the corrupted body when the status line is correct), but the root defect — an uncleaned output buffer in Server::start()'s exception-recovery path — is present on both. A client that inspects the body of a non-2xx WebDAV response (e.g. to surface the Sabre exception message for diagnostics) would still receive non-well-formed XML on either PHP version.

Suggested fix direction

apps/dav/lib/Connector/Sabre/Server::start()'s catch (\Throwable $e) block should discard any partial output already written before building and sending its own corrective error response — e.g. while (ob_get_level() > 0) { ob_end_clean(); } (guarded appropriately) before constructing the DOMDocument error response, or by tracking whether the $streamMultiStatus closure had already started writing and, if so, ensuring the connection is aborted/reset rather than layering a second response on top. Simply reverting Server::$streamMultiStatus = true also avoids the issue entirely, since the non-streaming path builds the multistatus string fully in memory and only calls $response->setBody($data) (never touching output directly), so a mid-generation exception never has partial body content to leak.

Happy to provide the exact request (Depth: 0 PROPFIND against a single not-yet-existing path — the ordinary "does this WebDAV resource exist" check) or additional captured raw responses if useful.

[dbartenstein]

Hi all! 👋

Is there any workaround available for this issue while running 34.0.2? Thanks!

Edit:
This also happens when trying to find out via PROPFIND if a file exists. So it’s not limited to .nomedia