Login broken on 3DS

[Albertfanmingo]

Describe the bug

On the 3DS's VERY old web browser attempting to log in shows the successful login redirect page, but then goes back to the login page. It never stays logged in. Using "?pw=foo" kind of works, but logs out on any page load so not really. The ?pw thing also gives a popup saying "could not list files in folder: error 403 access denied try pressing F5, maybe you got logged out" which is strange because it does list the files.

To Reproduce

1. use a 3ds
2. log in

Server details (if you're NOT using docker/podman)

Latest sfx (1.20.14)
As a systemd service

• run copyparty with --version and grab the last 3 lines (they start with copyparty, CPython, sqlite) and paste them below this line:

copyparty v1.20.14 "sftp is fine too" (2026-04-24)
  CPython v3.11.2 on Linux64 6.12.75 [GCC 12.2.0]
   sqlite 3.40.1*1 | jinja 3.1.2 | pyftpd 1.5.10 | tftp 0.4.0 | miko (None)

• copyparty arguments and/or config-file:

[global]
  p: 8086, 3939  # listen on ports 8086 and 3939
  e2dsa  # enable file indexing and filesystem scanning
  e2ts   # and enable multimedia indexing
  z, qr  # and zeroconf and qrcode (you can comma-separate arguments)
  cookie-lax
  no-bauth
  
# create users:
[accounts]
  rat: BAR   # username: password
  admin: BAZ
  creature: QUUX

# create volumes:
[/]         # create a volume at "/" (the webroot), which will
  /home/FOO/Copyparty/root     
  accs:
    A: admin   # all

# let's specify different permissions for the "priv" subfolder
# by creating another volume at that location:
 [/stache_stash]
  /home/FOO/Copyparty/root/stache_stash
  accs:
    rwm: rat 
    A: admin  

 [/public]
  /home/FOO/Copyparty/root/public
  accs:
    rwm: rat
    A: admin
    r: *
    
 [/creatures]
  /home/FOO/Copyparty/root/creatures
  accs:
    rm: creature
    wGd: creature
    A: admin

Client details

if the issue is possibly on the client-side, then mention some of the following:

• the device type and model:
  New 3DS XL
• OS version:
  Newest one
• browser version:
  1.12.10178

Server log

if the issue might be server-related, include everything that appears in the copyparty log during startup, and also anything else you think might be relevant

Logs after typing in password:

May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.114 172.59.155.129 41796   LOG: POST /stache_stash/UNRATLATED/DUNKING%20A%20BASKETBALL%20ON%20ICE%20SKATES.webm @*
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.114 172.59.155.129 41796   LOG:  `-- 'stache_stash/UNRATLATED/DUNKING A BASKETBALL ON ICE SKATES.webm'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796   LOG: boundary='----WebKitFormBoundarypniTjM4FOrDIM1vV'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796   LOG: 'Content-Disposition: form-data; name="act"'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796   LOG: 'Content-Disposition: form-data; name="cppwd"'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.115 172.59.155.129 41796   LOG: 'Content-Disposition: form-data; name="uhash"'
May 23 22:02:20 raspberrypi copyparty[10024]: 22:02:20.305 172.59.155.129 41796   LOG: GET  /favicon.ico @*
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.081 172.59.155.129 41796   LOG: GET  /stache_stash/UNRATLATED/DUNKING%20A%20BASKETBALL%20ON%20ICE%20SKATES.webm @*
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.081 172.59.155.129 41796   LOG:  `-- 'stache_stash/UNRATLATED/DUNKING A BASKETBALL ON ICE SKATES.webm'
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.081 172.59.155.129 41796   LOG: @* has no access to '/stache_stash/UNRATLATED/DUNKING A BASKETBALL ON ICE SKATES.webm'
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.676 172.59.155.129 38352   LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 22:02:21 raspberrypi copyparty[10024]: 22:02:21.702 172.59.155.129 38355   LOG: AES256-GCM-SHA384 TLSv1.2 256

Logs after loading site with ?pw:

May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.123 172.59.155.129 4496    LOG: shut(28): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.131 172.59.155.129 31640   LOG: shut(8): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.132 172.59.155.129 1162    LOG: shut(29): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.134 172.59.155.129 1386    LOG: shut(30): ok; client has already disconnected; 107
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.772 172.59.155.129 14745   LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:52 raspberrypi copyparty[10024]: 21:53:52.873 172.59.155.129 14745   LOG: GET  /stache_stash/UNRATLATED/?pw= rat  @rat
May 23 21:53:53 raspberrypi copyparty[10024]: 21:53:53.405 172.59.155.129 11250   LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:53 raspberrypi copyparty[10024]: 21:53:53.418 172.59.155.129 58906   LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:53 raspberrypi copyparty[10024]: 21:53:53.433 172.59.155.129 38555   LOG: AES256-GCM-SHA384 TLSv1.2 256
May 23 21:53:55 raspberrypi copyparty[10024]: 21:53:55.093 172.59.155.129 58906   LOG: GET  /?setck=js=y @*
May 23 21:53:55 raspberrypi copyparty[10024]: 21:53:55.604 172.59.155.129 38555   LOG: GET  /stache_stash/UNRATLATED/?ls @*

Additional context

I've tried the cookie-lax and no-bauth options and they didn't work :(. I'm guessing it's a cookie issue but I'm not sure

[bxtcns4tdp-art]

Lmao

[9001]

someone unrelatedly pulled out a new 3ds xl so took the opportunity to test but we couldn't reproduce the issue; we tried python3 -m copyparty -v srv/x::r,ed -aed:ok -p 3939 --ihead * --ohead * and connected directly to the copyparty over http over wan (not through a reverseproxy or lan), however those details shouldn't be relevant -- could you try running with ihead: * and ohead: * and see what the 3ds does in your case?

12:49:19.731 61.8.129.170 2515     [H] referer: [http://ocv.me:3939/]
12:49:19.731 61.8.129.170 2515     [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) Appl
eWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.EU]
12:49:19.731 61.8.129.170 2515     POST / @*
12:49:19.731 61.8.129.170 2515     boundary='----WebKitFormBoundary3eZjjYDXUnkbh6CD'
12:49:19.731 61.8.129.170 2515     'Content-Disposition: form-data; name="act"'
12:49:19.732 61.8.129.170 2515     'Content-Disposition: form-data; name="cppwd"'
12:49:19.732 61.8.129.170 2515     'Content-Disposition: form-data; name="uhash"'
12:49:19.732 61.8.129.170 2515     [O] Content-Length: [858]
12:49:19.733 61.8.129.170 2515     [O] Connection: [Keep-Alive]
12:49:19.733 61.8.129.170 2515     [O] Date: [Sat, 30 May 2026 12:49:19 GMT]
12:49:19.733 61.8.129.170 2515     [O] Cache-Control: [no-store, max-age=0]
12:49:19.733 61.8.129.170 2515     [O] Access-Control-Allow-Origin: [http://ocv.me:3939]
12:49:19.733 61.8.129.170 2515     [O] Access-Control-Allow-Methods: [GET, HEAD]
12:49:19.733 61.8.129.170 2515     [O] Access-Control-Allow-Headers: [Range]
12:49:19.733 61.8.129.170 2515     [O] Set-Cookie: [cppwd= ed ; Path=/; Expires=Sun, 02 May 2027 10
:49:19 GMT; HttpOnly; SameSite=Strict]
12:49:19.733 61.8.129.170 2515     [O] Content-Type: [text/html; charset=utf-8]
12:49:19.733 61.8.129.170 2515     [O] X-Content-Type-Options: [nosniff]
12:49:19.733 61.8.129.170 2515     [O] Vary: [Origin, PW, Cookie]
12:49:20.636 61.8.129.170 2515     [H] accept: [text/html,application/xhtml+xml,application/xml;q=0
.9,*/*;q=0.8]
12:49:20.636 61.8.129.170 2515     [H] accept-encoding: [gzip, deflate]
12:49:20.636 61.8.129.170 2515     [H] accept-language: [en]
12:49:20.636 61.8.129.170 2515     [H] cookie: [cppwd= ed ]
12:49:20.636 61.8.129.170 2515     [H] host: [ocv.me:3939]
12:49:20.636 61.8.129.170 2515     [H] referer: [http://ocv.me:3939/]
12:49:20.636 61.8.129.170 2515     [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) Appl
eWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.EU]
12:49:20.637 61.8.129.170 2515     GET  / @ed
12:49:20.638 61.8.129.170 2515     [O] Content-Length: [4835]
12:49:20.638 61.8.129.170 2515     [O] Connection: [Keep-Alive]
12:49:20.638 61.8.129.170 2515     [O] Date: [Sat, 30 May 2026 12:49:20 GMT]
12:49:20.638 61.8.129.170 2515     [O] Cache-Control: [no-store, max-age=0]
12:49:20.638 61.8.129.170 2515     [O] Set-Cookie: [cppwd= ed ; Path=/; Expires=Sun, 02 May 2027 10
:49:20 GMT; HttpOnly; SameSite=Strict]
12:49:20.638 61.8.129.170 2515     [O] Content-Type: [text/html; charset=utf-8]
12:49:20.638 61.8.129.170 2515     [O] X-Content-Type-Options: [nosniff]
12:49:20.638 61.8.129.170 2515     [O] Vary: [Origin, PW, Cookie]
12:49:22.908 61.8.129.170 2518     [H] accept: [*/*]
12:49:22.908 61.8.129.170 2518     [H] accept-encoding: [gzip, deflate]
12:49:22.909 61.8.129.170 2518     [H] accept-language: [en]
12:49:22.909 61.8.129.170 2518     [H] cookie: [cppwd= ed ]
12:49:22.909 61.8.129.170 2518     [H] host: [ocv.me:3939]
12:49:22.909 61.8.129.170 2518     [H] referer: [http://ocv.me:3939/]
12:49:22.909 61.8.129.170 2518     [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) Appl
eWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.EU]
12:49:22.909 61.8.129.170 2518     GET  /?setck=js=y @ed
12:49:22.909 61.8.129.170 2518     [O] Content-Length: [3]
12:49:22.909 61.8.129.170 2518     [O] Connection: [Keep-Alive]
12:49:22.909 61.8.129.170 2518     [O] Date: [Sat, 30 May 2026 12:49:22 GMT]
12:49:22.909 61.8.129.170 2518     [O] Cache-Control: [no-store, max-age=0]
12:49:22.909 61.8.129.170 2518     [O] Content-Type: [text/html; charset=utf-8]
12:49:22.909 61.8.129.170 2518     [O] Set-Cookie: [js=y; Path=/; Expires=Thu, 25 Mar 2027 12:49:22
 GMT; SameSite=Lax]
12:49:22.909 61.8.129.170 2518     [O] X-Content-Type-Options: [nosniff]
12:49:22.909 61.8.129.170 2518     [O] Vary: [Origin, PW, Cookie]
12:49:23.248 61.8.129.170 2515     shut(7): ok; client has already disconnected; 107

[Albertfanmingo]

Here are the logs after enabling ihead and ohead, and then reconnecting and logging in. It seems to be missing any js stuff? Like line GET /?setck=js=y is missing.

Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.165 147.185.133.210 64514  LOG: GET  / @*
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.169 147.185.133.210 64514  LOG: [O] Content-Length: [2334]
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.169 147.185.133.210 64514  LOG: [O] Connection: [Keep-Alive]
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.169 147.185.133.210 64514  LOG: [O] Date: [Tue, 02 Jun 2026 02:48:10 GMT]
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.170 147.185.133.210 64514  LOG: [O] Cache-Control: [no-store, max-age=0]
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.170 147.185.133.210 64514  LOG: [O] Content-Type: [text/html; charset=utf-8]
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.170 147.185.133.210 64514  LOG: [O] X-Content-Type-Options: [nosniff]
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.170 147.185.133.210 64514  LOG: [O] X-Robots-Tag: [noindex, nofollow]
Jun 01 20:48:10 raspberrypi copyparty[3270]: 20:48:10.170 147.185.133.210 64514  LOG: [O] Vary: [Origin, PW, Cookie]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] accept: [text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] accept-encoding: [gzip, deflate]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] accept-language: [en-US,en;q=0.5]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] cache-control: [no-cache]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] host: [IP:3939]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] pragma: [no-cache]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] referer: [http://IP:3939/]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     BTW: [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.US]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.603 192.168.86.1 57336     LOG: GET  / @*
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.605 192.168.86.1 57336     LOG: [O] Content-Length: [2334]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.606 192.168.86.1 57336     LOG: [O] Connection: [Keep-Alive]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.606 192.168.86.1 57336     LOG: [O] Date: [Tue, 02 Jun 2026 02:53:10 GMT]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.606 192.168.86.1 57336     LOG: [O] Cache-Control: [no-store, max-age=0]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.606 192.168.86.1 57336     LOG: [O] Content-Type: [text/html; charset=utf-8]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.606 192.168.86.1 57336     LOG: [O] X-Content-Type-Options: [nosniff]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.606 192.168.86.1 57336     LOG: [O] X-Robots-Tag: [noindex, nofollow]
Jun 01 20:53:10 raspberrypi copyparty[3270]: 20:53:10.606 192.168.86.1 57336     LOG: [O] Vary: [Origin, PW, Cookie]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.819 192.168.86.1 57347     BTW: [H] accept: [text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] accept-encoding: [gzip, deflate]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] accept-language: [en-US,en;q=0.5]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] content-length: [329]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] content-type: [multipart/form-data; boundary=----WebKitFormBoundaryvN6su50gR1Z2Qi8d]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] host: [IP:3939]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] origin: [http://IP:3939]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] referer: [http://IP:3939/]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.820 192.168.86.1 57347     BTW: [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.US]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.821 192.168.86.1 57347     LOG: POST / @*
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.821 192.168.86.1 57347     LOG: boundary='----WebKitFormBoundaryvN6su50gR1Z2Qi8d'
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.822 192.168.86.1 57347     LOG: 'Content-Disposition: form-data; name="act"'
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.822 192.168.86.1 57347     LOG: 'Content-Disposition: form-data; name="cppwd"'
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.822 192.168.86.1 57347     LOG: 'Content-Disposition: form-data; name="uhash"'
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.825 192.168.86.1 57347     LOG: [O] Content-Length: [915]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.826 192.168.86.1 57347     LOG: [O] Connection: [Keep-Alive]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.826 192.168.86.1 57347     LOG: [O] Date: [Tue, 02 Jun 2026 02:53:20 GMT]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.826 192.168.86.1 57347     LOG: [O] Cache-Control: [no-store, max-age=0]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.826 192.168.86.1 57347     LOG: [O] Access-Control-Allow-Origin: [http://IP:3939]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.826 192.168.86.1 57347     LOG: [O] Access-Control-Allow-Methods: [GET, HEAD]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.826 192.168.86.1 57347     LOG: [O] Access-Control-Allow-Headers: [Range]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.827 192.168.86.1 57347     LOG: [O] Set-Cookie: [cppwd= rat ; Path=/; Expires=Wed, 05 May 2027 00:53:20 GMT; HttpOnly; SameSite=Lax]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.827 192.168.86.1 57347     LOG: [O] Content-Type: [text/html; charset=utf-8]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.827 192.168.86.1 57347     LOG: [O] X-Content-Type-Options: [nosniff]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.827 192.168.86.1 57347     LOG: [O] X-Robots-Tag: [noindex, nofollow]
Jun 01 20:53:20 raspberrypi copyparty[3270]: 20:53:20.827 192.168.86.1 57347     LOG: [O] Vary: [Origin, PW, Cookie]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.674 192.168.86.1 57347     BTW: [H] accept: [text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.674 192.168.86.1 57347     BTW: [H] accept-encoding: [gzip, deflate]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.675 192.168.86.1 57347     BTW: [H] accept-language: [en-US,en;q=0.5]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.675 192.168.86.1 57347     BTW: [H] host: [IP:3939]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.675 192.168.86.1 57347     BTW: [H] referer: [http://IP:3939/]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.675 192.168.86.1 57347     BTW: [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.US]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.675 192.168.86.1 57347     LOG: GET  / @*
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] Content-Length: [2334]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] Connection: [Keep-Alive]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] Date: [Tue, 02 Jun 2026 02:53:21 GMT]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] Cache-Control: [no-store, max-age=0]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] Content-Type: [text/html; charset=utf-8]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] X-Content-Type-Options: [nosniff]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] X-Robots-Tag: [noindex, nofollow]
Jun 01 20:53:21 raspberrypi copyparty[3270]: 20:53:21.676 192.168.86.1 57347     LOG: [O] Vary: [Origin, PW, Cookie]```

[tilse]

here's a comparison between a 3DS login on the left and desktop firefox

[tilse]

here are the full logs in text form

3DS:

19:34:46.208 192.168.2.168 60444   [H] accept: [text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
19:34:46.208 192.168.2.168 60444   [H] accept-encoding: [gzip, deflate]
19:34:46.208 192.168.2.168 60444   [H] accept-language: [en]
19:34:46.208 192.168.2.168 60444   [H] content-length: [325]
19:34:46.208 192.168.2.168 60444   [H] content-type: [multipart/form-data; boundary=----WebKitFormBoundarymfz49cfQCu0bCqQ4]
19:34:46.208 192.168.2.168 60444   [H] host: [192.168.2.164:3939]
19:34:46.208 192.168.2.168 60444   [H] origin: [http://192.168.2.164:3939]
19:34:46.208 192.168.2.168 60444   [H] referer: [http://192.168.2.164:3939/]
19:34:46.208 192.168.2.168 60444   [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.EU]
19:34:46.208 192.168.2.168 60444   POST / @*
19:34:46.208 192.168.2.168 60444   boundary='----WebKitFormBoundarymfz49cfQCu0bCqQ4'
19:34:46.208 192.168.2.168 60444   'Content-Disposition: form-data; name="act"'
19:34:46.208 192.168.2.168 60444   'Content-Disposition: form-data; name="cppwd"'
19:34:46.208 192.168.2.168 60444   'Content-Disposition: form-data; name="uhash"'
19:34:46.209 192.168.2.168 60444   [O] Content-Length: [887]
19:34:46.209 192.168.2.168 60444   [O] Connection: [Keep-Alive]
19:34:46.209 192.168.2.168 60444   [O] Date: [Wed, 03 Jun 2026 17:34:46 GMT]
19:34:46.209 192.168.2.168 60444   [O] Cache-Control: [no-store, max-age=0]
19:34:46.209 192.168.2.168 60444   [O] Access-Control-Allow-Origin: [http://192.168.2.164:3939]
19:34:46.209 192.168.2.168 60444   [O] Access-Control-Allow-Methods: [GET, HEAD]
19:34:46.209 192.168.2.168 60444   [O] Access-Control-Allow-Headers: [Range]
19:34:46.209 192.168.2.168 60444   [O] Set-Cookie: [cppwd= ed ; Path=/; Expires=Thu, 06 May 2027 15:34:46 GMT; HttpOnly; SameSite=Strict]
19:34:46.209 192.168.2.168 60444   [O] Content-Type: [text/html; charset=utf-8]
19:34:46.209 192.168.2.168 60444   [O] X-Content-Type-Options: [nosniff]
19:34:46.209 192.168.2.168 60444   [O] Vary: [Origin, PW, Cookie]
19:34:47.077 192.168.2.168 60444   [H] accept: [text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
19:34:47.077 192.168.2.168 60444   [H] accept-encoding: [gzip, deflate]
19:34:47.077 192.168.2.168 60444   [H] accept-language: [en]
19:34:47.077 192.168.2.168 60444   [H] host: [192.168.2.164:3939]
19:34:47.077 192.168.2.168 60444   [H] referer: [http://192.168.2.164:3939/]
19:34:47.077 192.168.2.168 60444   [H] user-agent: [Mozilla/5.0 (New Nintendo 3DS like iPhone) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.0.5.24 Mobile NintendoBrowser/1.12.10178.EU]
19:34:47.078 192.168.2.168 60444   GET  / @*
19:34:47.078 192.168.2.168 60444   [O] Content-Length: [2118]
19:34:47.078 192.168.2.168 60444   [O] Connection: [Keep-Alive]
19:34:47.078 192.168.2.168 60444   [O] Date: [Wed, 03 Jun 2026 17:34:47 GMT]
19:34:47.078 192.168.2.168 60444   [O] Cache-Control: [no-store, max-age=0]
19:34:47.078 192.168.2.168 60444   [O] Content-Type: [text/html; charset=utf-8]
19:34:47.078 192.168.2.168 60444   [O] X-Content-Type-Options: [nosniff]
19:34:47.078 192.168.2.168 60444   [O] Vary: [Origin, PW, Cookie]

Desktop FF:

19:38:09.031 127.0.0.1 57750       [H] accept: [text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
19:38:09.031 127.0.0.1 57750       [H] accept-encoding: [gzip, deflate, br, zstd]
19:38:09.031 127.0.0.1 57750       [H] accept-language: [en-US,en;q=0.9]
19:38:09.031 127.0.0.1 57750       [H] connection: [keep-alive]
19:38:09.031 127.0.0.1 57750       [H] content-length: [385]
19:38:09.031 127.0.0.1 57750       [H] content-type: [multipart/form-data; boundary=----geckoformboundarydb90e281b30ec7321b44d332b8b79440]
19:38:09.031 127.0.0.1 57750       [H] cookie: [js=y]
19:38:09.031 127.0.0.1 57750       [H] host: [localhost:3939]
19:38:09.031 127.0.0.1 57750       [H] origin: [http://localhost:3939]
19:38:09.031 127.0.0.1 57750       [H] priority: [u=0, i]
19:38:09.031 127.0.0.1 57750       [H] referer: [http://localhost:3939/]
19:38:09.031 127.0.0.1 57750       [H] sec-fetch-dest: [document]
19:38:09.031 127.0.0.1 57750       [H] sec-fetch-mode: [navigate]
19:38:09.031 127.0.0.1 57750       [H] sec-fetch-site: [same-origin]
19:38:09.031 127.0.0.1 57750       [H] sec-fetch-user: [?1]
19:38:09.031 127.0.0.1 57750       [H] upgrade-insecure-requests: [1]
19:38:09.031 127.0.0.1 57750       [H] user-agent: [Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0]
19:38:09.031 127.0.0.1 57750       POST / @*
19:38:09.031 127.0.0.1 57750       boundary='----geckoformboundarydb90e281b30ec7321b44d332b8b79440'
19:38:09.031 127.0.0.1 57750       'Content-Disposition: form-data; name="act"'
19:38:09.031 127.0.0.1 57750       'Content-Disposition: form-data; name="cppwd"'
19:38:09.031 127.0.0.1 57750       'Content-Disposition: form-data; name="uhash"'
19:38:09.032 127.0.0.1 57750       [O] Content-Length: [887]
19:38:09.032 127.0.0.1 57750       [O] Connection: [Keep-Alive]
19:38:09.032 127.0.0.1 57750       [O] Date: [Wed, 03 Jun 2026 17:38:09 GMT]
19:38:09.032 127.0.0.1 57750       [O] Cache-Control: [no-store, max-age=0]
19:38:09.032 127.0.0.1 57750       [O] Access-Control-Allow-Origin: [http://localhost:3939]
19:38:09.032 127.0.0.1 57750       [O] Access-Control-Allow-Methods: [GET, HEAD]
19:38:09.032 127.0.0.1 57750       [O] Access-Control-Allow-Headers: [Range]
19:38:09.032 127.0.0.1 57750       [O] Set-Cookie: [cppwd= ed ; Path=/; Expires=Thu, 06 May 2027 15:38:09 GMT; HttpOnly; SameSite=Strict]
19:38:09.032 127.0.0.1 57750       [O] Content-Type: [text/html; charset=utf-8]
19:38:09.032 127.0.0.1 57750       [O] X-Content-Type-Options: [nosniff]
19:38:09.032 127.0.0.1 57750       [O] Vary: [Origin, PW, Cookie]
19:38:09.114 127.0.0.1 57750       [H] accept: [image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5]
19:38:09.114 127.0.0.1 57750       [H] accept-encoding: [gzip, deflate, br, zstd]
19:38:09.114 127.0.0.1 57750       [H] accept-language: [en-US,en;q=0.9]
19:38:09.114 127.0.0.1 57750       [H] connection: [keep-alive]
19:38:09.114 127.0.0.1 57750       [H] cookie: [js=y; cppwd= ed ]
19:38:09.114 127.0.0.1 57750       [H] host: [localhost:3939]
19:38:09.114 127.0.0.1 57750       [H] priority: [u=6]
19:38:09.114 127.0.0.1 57750       [H] referer: [http://localhost:3939/]
19:38:09.114 127.0.0.1 57750       [H] sec-fetch-dest: [image]
19:38:09.114 127.0.0.1 57750       [H] sec-fetch-mode: [no-cors]
19:38:09.114 127.0.0.1 57750       [H] sec-fetch-site: [same-origin]
19:38:09.114 127.0.0.1 57750       [H] user-agent: [Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0]
19:38:09.114 127.0.0.1 57750       GET  /favicon.ico @ed
19:38:09.114 127.0.0.1 57750       [O] Content-Length: [2494]
19:38:09.114 127.0.0.1 57750       [O] Connection: [Keep-Alive]
19:38:09.114 127.0.0.1 57750       [O] Date: [Wed, 03 Jun 2026 17:38:09 GMT]
19:38:09.114 127.0.0.1 57750       [O] Cache-Control: [no-store, max-age=0]
19:38:09.114 127.0.0.1 57750       [O] Content-Type: [text/html; charset=utf-8]
19:38:09.114 127.0.0.1 57750       [O] X-Content-Type-Options: [nosniff]
19:38:09.114 127.0.0.1 57750       [O] Vary: [Origin, PW, Cookie]
19:38:09.857 127.0.0.1 57750       [H] accept: [text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
19:38:09.857 127.0.0.1 57750       [H] accept-encoding: [gzip, deflate, br, zstd]
19:38:09.857 127.0.0.1 57750       [H] accept-language: [en-US,en;q=0.9]
19:38:09.857 127.0.0.1 57750       [H] connection: [keep-alive]
19:38:09.857 127.0.0.1 57750       [H] cookie: [js=y; cppwd= ed ]
19:38:09.857 127.0.0.1 57750       [H] host: [localhost:3939]
19:38:09.857 127.0.0.1 57750       [H] priority: [u=0, i]
19:38:09.857 127.0.0.1 57750       [H] referer: [http://localhost:3939/]
19:38:09.857 127.0.0.1 57750       [H] sec-fetch-dest: [document]
19:38:09.857 127.0.0.1 57750       [H] sec-fetch-mode: [navigate]
19:38:09.857 127.0.0.1 57750       [H] sec-fetch-site: [same-origin]
19:38:09.857 127.0.0.1 57750       [H] upgrade-insecure-requests: [1]
19:38:09.857 127.0.0.1 57750       [H] user-agent: [Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0]
19:38:09.857 127.0.0.1 57750       GET  / @ed
19:38:09.858 127.0.0.1 57750       [O] Content-Length: [4964]
19:38:09.858 127.0.0.1 57750       [O] Connection: [Keep-Alive]
19:38:09.858 127.0.0.1 57750       [O] Date: [Wed, 03 Jun 2026 17:38:09 GMT]
19:38:09.858 127.0.0.1 57750       [O] Cache-Control: [no-store, max-age=0]
19:38:09.858 127.0.0.1 57750       [O] Content-Type: [text/html; charset=utf-8]
19:38:09.858 127.0.0.1 57750       [O] X-Content-Type-Options: [nosniff]
19:38:09.858 127.0.0.1 57750       [O] Vary: [Origin, PW, Cookie]
19:38:09.983 127.0.0.1 59680       [H] accept: [*/*]
19:38:09.983 127.0.0.1 59680       [H] accept-encoding: [gzip, deflate, br, zstd]
19:38:09.984 127.0.0.1 59680       [H] accept-language: [en-US,en;q=0.9]
19:38:09.984 127.0.0.1 59680       [H] connection: [keep-alive]
19:38:09.984 127.0.0.1 59680       [H] cookie: [js=y; cppwd= ed ]
19:38:09.984 127.0.0.1 59680       [H] host: [localhost:3939]
19:38:09.984 127.0.0.1 59680       [H] referer: [http://localhost:3939/]
19:38:09.984 127.0.0.1 59680       [H] sec-fetch-dest: [empty]
19:38:09.984 127.0.0.1 59680       [H] sec-fetch-mode: [cors]
19:38:09.984 127.0.0.1 59680       [H] sec-fetch-site: [same-origin]
19:38:09.984 127.0.0.1 59680       [H] user-agent: [Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0]
19:38:09.984 127.0.0.1 59680       GET  /?tree= @ed
19:38:09.984 127.0.0.1 59680       [O] Content-Length: [9]
19:38:09.984 127.0.0.1 59680       [O] Connection: [Keep-Alive]
19:38:09.984 127.0.0.1 59680       [O] Date: [Wed, 03 Jun 2026 17:38:09 GMT]
19:38:09.984 127.0.0.1 59680       [O] Cache-Control: [no-store, max-age=0]
19:38:09.984 127.0.0.1 59680       [O] Content-Type: [application/json]
19:38:09.984 127.0.0.1 59680       [O] X-Content-Type-Options: [nosniff]
19:38:09.984 127.0.0.1 59680       [O] Vary: [Origin, PW, Cookie]

[tilse]

i managed to figure it out.
the 3ds doesn't keep cookies around for raw IP addresses. if you have a dns, it works.
so: connecting to http://a.ocv.me:3923 would work,
but connecting to http://192.168.0.100:3923 doesn't

however i still can't seem to make it work with my own instance because the reverse proxy i use on top of that seems to break it again.