Restoring a deleted card via the "Undo" button fails

[ReMeWebsolutely]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Describe the bug
Restoring a deleted card via the "Undo" button fails with an HTTP 400 Bad Request. The Vue.js frontend (Axios) fails to include the mandatory OCS-APIRequest: true header in the PUT request, causing strict web servers/PHP to reject the payload immediately.

To Reproduce
Steps to reproduce the behavior:

1. Delete any existing card in a Deck board.
2. Navigate to the "Deleted items" sidebar.
3. Click the "Undo" (restore) icon next to the deleted card.
4. Inspect the network tab in the browser dev tools.

Expected behavior
The frontend should dispatch a PUT request to /ocs/v2.php/apps/deck/api/v1.0/cards/{id} that includes the OCS-APIRequest: true header to pass the OCS API CSRF protection, successfully restoring the card.

**Actual behaviour
The Axios client fires the PUT request but entirely omits the OCS-APIRequest: true header. Additionally, it sends a malformed duplicate header: X-Requested-With: XMLHttpRequest, XMLHttpRequest.
Because the CSRF header is missing, the Nextcloud OCS API (and strict web servers like LiteSpeed) immediately drop the request with HTTP 400 Bad Request and Content-Length: 0. The card remains in the trash bin.

Screenshots

Client details:
Browser: Firefox 157.0 (also affects other browsers)
Operating system: Windows 10

Server details

Operating system: AlmaLinux 10

**Web server: LiteSpeed 6.3.7(b2)

Database:

**PHP version: 8.4

Nextcloud version: Nextcloud Hub 26 Spring 34.0.3

**Where did you install Nextcloud from: via Plesk Extension

Signing status:

Login as admin user into your Nextcloud and access
http://example.com/index.php/settings/integrity/failed
paste the results here.
No errors have been found.

**List of activated apps:**

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder
Enabled:

• activity: 7.0.0
• admin_audit: 1.24.0
• ak_language_switcher: 1.0.3
• analytics: 6.8.1
• appstore: 1.0.0
• bookmarks: 16.2.7
• bruteforcesettings: 7.0.0
• calendar: 6.6.1
• circles: 34.0.0
• cloud_federation_api: 1.18.0
• collectives: 4.7.0
• comments: 1.24.0
• contacts: 8.9.0
• contactsinteraction: 1.15.0
• dashboard: 7.14.0
• dav: 1.40.0
• deck: 1.18.5
• eurooffice: 11.0.5
• event_update_notification: 2.10.0
• external: 9.0.1
• federatedfilesharing: 1.24.0
• federation: 1.24.0
• files: 2.6.0
• files_accesscontrol: 5.0.0
• files_automatedtagging: 5.0.0
• files_downloadlimit: 5.2.0
• files_external: 1.26.0
• files_lock: 34.0.1
• files_pdfviewer: 7.0.0-dev.0
• files_reminders: 1.7.0
• files_sharing: 1.26.0
• files_trashbin: 1.24.0
• files_versions: 1.27.0
• groupfolders: 22.0.6
• impersonate: 5.0.0
• logreader: 7.0.0
• lookup_server_connector: 1.22.0
• mail: 5.12.0
• nextcloud_announcements: 6.0.0
• notes: 6.1.0
• notifications: 7.0.0-dev.1
• notify_push: 1.4.1
• oauth2: 1.22.0
• office: 1.0.0
• password_policy: 6.0.0-dev.0
• photos: 7.0.0
• privacy: 6.0.0-dev.1
• profile: 1.3.0
• profile_fields: 4.0.0
• provisioning_api: 1.24.0
• recommendations: 7.0.0
• related_resources: 5.0.0-dev.0
• secrets: 3.0.6
• serverinfo: 6.0.0
• settings: 1.17.0
• sharebymail: 1.24.0
• side_menu: 6.2.0
• spreed: 24.0.5
• support: 6.0.0
• teamhub: 4.10.0
• text: 8.0.0
• theming: 2.9.0
• theming_customcss: 1.22.0
• twofactor_backupcodes: 1.23.0
• twofactor_totp: 16.0.0
• updatenotification: 1.24.0
• user_status: 1.14.0
• viewer: 7.0.0-dev.0
• weather_status: 1.14.0
• webhook_listeners: 1.6.0
• whiteboard: 2.0.0
• workflowengine: 2.16.0
  Disabled:
• app_api: 34.0.0 (installed 34.0.0)
• encryption: 2.22.0
• firstrunwizard: 7.0.0-dev.0 (installed 7.0.0-dev.0)
• formvox: 1.4.1 (installed 1.4.1)
• survey_client: 6.0.0-dev.0 (installed 5.0.0)
• suspicious_login: 12.0.0-dev.0
• systemtags: 1.24.0 (installed 1.24.0)
• twofactor_nextcloud_notification: 8.0.0
• user_ldap: 1.25.0

Nextcloud configuration:

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

or

Insert your config.php content here
Make sure to remove all sensitive content such as passwords. (e.g. database password, passwordsalt, secret, smtp password, …)
{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***REMOVED***"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.3.2",
        "overwrite.cli.url": "https:\/\/***REMOVED***",
        "overwriteprotocol": "https",
        "htaccess.RewriteBase": "\/",
        "front_controller_active": true,
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "***REMOVED***",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtpauth": true,
        "mail_sendmailmode": "smtp",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "mail_smtpport": "465",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": ***REMOVED***,
            "password": "***REMOVED SENSITIVE VALUE***",
            "dbindex":***REMOVED***,
            "timeout": 1.5
        },
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "default_phone_region": "AT",
        "maintenance_window_start": ***REMOVED***,
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin"
        ],
        "twofactor_enforced_excluded_groups": [],
        "app_install_overwrite": [
            "ak_language_switcher"
        ],
        "objectstore": {
            "class": "\\OC\\Files\\ObjectStore\\S3",
            "arguments": {
                "bucket": "***REMOVED***",
                "autocreate": false,
                "key": "***REMOVED SENSITIVE VALUE***",
                "secret": "***REMOVED SENSITIVE VALUE***",
                "hostname": "***REMOVED***",
                "port": 443,
                "use_ssl": true,
                "region": "de",
                "use_path_style": false
            }
        },
        "defaultapp": "teamhub,dashboard,files",
        "skeletondirectory": ""
    }
}

**Are you using an external user-backend, if yes which one:** LDAP/ActiveDirectory/Webdav/...

</details>

<details>
<summary>Logs</summary>

#### Nextcloud log (data/nextcloud.log)

Insert your Nextcloud log here
nothing in addition with value to insert here

Browser log

Insert your browser log here, this could for example include:

nothing in addition with value to insert here

</details>

[grnd-alt]

thanks for reporting! fixed on main, now also on stable34 and 35!