Server crashes Supersonic app (subsonic)

[Masterlocker]

I'm having issues with desktop app Supersonic which is connecting to my nextcloud and works most of it like album,artists etc. and only crashes when i want to get all tracks. I already talked with dev of Supersonic and he made some kind of failsafe for it but still doesn't find any problem on his side but more likely of this app.
Supersonic github: https://github.com/dweymouth/supersonic
Also attaching the screenshot of error.

[paulijar]

Thanks for the report.

I'd say that this is primarily a Supersonic bug since it's the one crashing. It's possible that also Nextcloud Music is doing something wrong here but it's a commonly agreed principle in SW engineering that external sources (like server or client) should never be trusted 100 % and any SW should be prepared also for a malformed input.

In my tests with Supersonic I haven't seen such problem so apparently it's some feature of your library which is needed to trigger the problem.

From the supplied client-side log, it's really difficult to tell what is actually going wrong. One thing I can see is that the last 14 lines are errors which indicate that the client has called some API endpoint without passing the username (i.e. the URL argument u). All the log lines before the repeating error have happened at least 1.5 minutes earlier so they might not be relevant for the crash.

[paulijar]

You could see the API endpoints called from the server end from nextcloud.log if you temporarily set the logging level to debug (0). Just don't forget this setting on as it makes the log file grow rapidly. While the debug logging is enabled, run your problem case and then distill the relevant lines from the log by executing

cat /path/to/your/nextcloud/data/nextcloud.log | grep 'Subsonic request'

Just be aware that each found line will contain your API key in plain text so you should censor the content before sharing.

[Masterlocker]

I got this from debug.
It spams couple of times the same.
So it's Supersonic bug then?

[paulijar]

Most of that is uninteresting noise which always fills the debug log. But the interesting one is the line with the message "User authentication required". Please check the details from that one.

In the details, the interesting part is the "url" but that's also where your API key may be visible. So if it contains a URL argument like p=abcdefg, then make sure to hide this value when sharing.

[Masterlocker]

{
"reqId": "some id",
"level": 0,
"time": "2025-07-14T11:19:59+00:00",
"remoteAddr": "192.168.192.80",
"user": "--",
"app": "music",
"method": "GET",
"url": "/index.php/apps/music/subsonic/rest/getAlbum?c=supersonic&f=xml&id=album-1&p=api-key&u=admin&v=1.15.0",
"message": "User authentication required",
"userAgent": "supersonic/0.16.0",
"version": "31.0.7.1",
"data": {
"app": "music"
},
"id": "some id"
}

[paulijar]

That's weird. The message "User authentication required" should be emitted only in case the URL argument u=... is missing but clearly there is u=admin present in the URL. And I don't see anything else out of ordinary in that URL, either. So I can't explain, how would it be logically possible to end up to this situation.

[Masterlocker]

So it's not Supersonic fault?

[paulijar]

The part where Supersonic crashes is still Supersonic's fault, but apparently, there's something wrong also in either Music, Nextcloud, or your server setup. With more graceful error handling, Supersonic should be able to avoid the crash but that would probably still leave some feature(s) non-functional.

How large is your music library? It might be worthwhile to test with a minimal setup where the user's library contains just one or a few songs.

[Masterlocker]

about 25-35 files? also it's not crashing with 1-8 files when i go to all track tab. My setup is done using Proxmox and LXC template of turnkey Nextcloud and it's fully updated to latest version, also no errors of configuration only warnings (not important ones) in admin tab of nextcloud. And the connection is going something like that MyPC->zerotier network -> OPNsense firewall (NAT) -> Nextcloud.

[paulijar]

Okay, 35 files is still a small library so that itself shouldn't be the issue. I tested this with a library of ~2000 songs and didn't get any other problem except that the All tracks view loads very slowly because it fetches albums one-by-one.

I wonder, is it possible that one specific file out of those 25-35 somehow triggers the problem. I can't figure out any plausible mechanism how it could do that, though.

And just for a sanity check, when there is no crash with 1-8 files, you don't get the "User authentication required" messages in the log, either?

[Masterlocker]

Uhh... now that i check i still get "User authentication required" and the p=... u=... exist. I even swapped for fresh files and moved old to avoid scan in music. Also again sometimes Supersonic shows 5 tracks sometime 4 or 7 (files don't have any special characters). Also i checked firewall and show no connection block....

[paulijar]

You could also try to navigate to the problematic URL on your browser: https://domain.of.your.cloud/index.php/apps/music/subsonic/rest/getAlbum?c=supersonic&f=xml&id=album-1&p=api-key&u=admin&v=1.15.0. That should show you the XML content. If you reload it multiple times, then does it maybe fail some of the times?

[Masterlocker]

I get this for first time

and after i refresh i got this

also i changed api key in url because other way i get "Wrong username or password" in message.
And after refreshing couple of times it's the same

[Masterlocker]

Wait.. i did more spam and i got

[paulijar]

Getting the "CORS requires basic auth" is kind of normal when you call this API on the same browser where you have an open session on the Nextcloud web UI. Somehow, Nextcloud doesn't like it when an API intended for cross-origin use is called in a context where there are valid session cookies present. After that first error, your ongoing session gets terminated and the API starts to work.

You have probably rescanned your library after the message #1237 (comment), which is why "album-1" no longer exists. When the library is rescanned from scratch, all artists, albums, and tracks get new IDs. To find out the current album IDs, you could fetch https://domain.of.your.cloud/index.php/apps/music/subsonic/rest/getAlbumList?type=alphabeticalByName&c=test&f=xml&p=your-api-key&u=your-user-name&v=1.15.0.

However, as you now managed to get the "User authentication required" by spamming the request, I would bet that the exact API endpoint called here is not actually important. It just happens to be so that Supersonic spams requests to that particular endpoint and not on any others. So do you get the same result if you just spam https://domain.of.your.cloud/index.php/apps/music/subsonic/rest/ping?c=test&f=xml&p=your-api-key&u=your-user-name&v=1.15.0 ?