Non-UUID XDG Portal restore token is rejected after service restart on KDE Plasma 6.7.2 when using w0vncserver

[Foriz Fennec]

Hello TigerVNC developers and users,

I believe I have found a reproducible issue with persistent display selection in w0vncserver when using the KDE XDG Remote Desktop Portal.I am running w0vncserver on an Arch Linux KDE Plasma Wayland session with:

    - TigerVNC 1.16.2
    - KDE Plasma 6.7.2
    - xdg-desktop-portal 1.22.1
    - xdg-desktop-portal-kde 6.7.2

w0vncserver is started as a systemd user service named:

    app-org.tigervnc.w0vncserver.service

The application also has KDE remote-desktop pre-authorization:

    kde-authorized remote-desktop org.tigervnc.w0vncserver yes

I set this pre-authorization because I need to use this PC for remote work and I have no way to permit the connection manually. I use:

    -RememberDisplayChoice=Always
    -QueryConnect=0

The initial connection works after I approve the KDE Portal dialog and select a display. w0vncserver then saves a restore token in:

    ~/.local/state/tigervnc/restoretoken

However, the token returned by KDE is not a UUID. In my tests it was a
22-character string, for example:

    KkWTDB...f3ew

The exact token above has been redacted.

After restarting w0vncserver with:

    systemctl --user restart app-org.tigervnc.w0vncserver.service

the next VNC connection requires local approval again. This makes unattended
remote access impossible after restarting the service or rebooting the machine.

Steps to reproduce:

1. Start a KDE Plasma Wayland session.

2. Clear any previously stored token:

       w0vncserver-forget

3. Start w0vncserver with:

       -RememberDisplayChoice=Always
       -QueryConnect=0

4. Connect from a VNC client.

5. Approve the KDE Portal dialog and select the display.

6. Verify that a restore token has been written to:

       ~/.local/state/tigervnc/restoretoken

7. Restart the service:

       systemctl --user restart app-org.tigervnc.w0vncserver.service

8. Connect again.

Actual result:

w0vncserver rejects the stored token, the journal says:

    RemoteDesktop: Invalid restore token, not a valid UUID string
                   "KkWTDB...f3ew"

KDE then presents the local approval/display-selection dialog again.

I expect that w0vncserver should load the restore token returned by the Portal and pass it back to the Portal after restarting. A valid stored session should not require
local approval again.

Source code observation:

In TigerVNC 1.16.2, RemoteDesktop::loadRestoreToken() appears to:

    - read the token into char restoreToken_[37]
    - require uuid_parse() to succeed

However, RemoteDesktop::storeRestoreToken() writes the string returned by the
Portal without applying the same UUID validation.

The XDG Desktop Portal RemoteDesktop interface documents restore_token as a
string ("s"). I could not find a requirement that this string must use UUID
format. Is the UUID-only validation intentional? Would it be appropriate for w0vncserver to treat the restore token as an opaque string instead of requiring uuid_parse() to succeed?

Please also let me know if there is already a patch or development branch that
I can test.

Environment and package information:

=== Operating system ===
NAME="Arch Linux"
PRETTY_NAME="Arch Linux"
ID=arch
BUILD_ID=rolling
ANSI_COLOR="38;2;23;147;209"
HOME_URL="https://archlinux.org/"
DOCUMENTATION_URL="https://wiki.archlinux.org/"
SUPPORT_URL="https://bbs.archlinux.org/"
BUG_REPORT_URL="https://gitlab.archlinux.org/groups/archlinux/-/issues"
PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/"
LOGO=archlinux-logo

=== Kernel ===
Linux Fennec 7.1.3-zen1-2-zen #1 ZEN SMP PREEMPT_DYNAMIC Thu, 09 Jul 2026 20:39:38 +0000 x86_64 GNU/Linux

=== Desktop session ===
plasmashell 6.7.2
XDG_SESSION_TYPE=wayland

=== TigerVNC ===
TigerVNC server version 1.16.2

=== Packages ===
tigervnc 1.16.2-4
plasma-workspace 6.7.2-1
kwin 6.7.2-1
xdg-desktop-portal 1.22.1-2
xdg-desktop-portal-kde 6.7.2-1

=== KDE remote desktop permission ===
kde-authorized  remote-desktop  org.tigervnc.w0vncserver        yes     0x00

systemd user service:

=== systemd unit ===
# <myhome>/.config/systemd/user/app-org.tigervnc.w0vncserver.service
[Unit]
Description=TigerVNC server for current KDE Wayland session
PartOf=graphical-session.target
Wants=xdg-desktop-portal.service
After=xdg-desktop-portal.service

[Service]
Type=simple
ExecStart=/usr/bin/w0vncserver -PasswordFile=%h/.config/tigervnc/passwd -RememberDisplayChoice=Always -QueryConnect=0
Restart=on-failure
RestartSec=3

[Install]
WantedBy=graphical-session.target

=== Process cgroup ===
PID=13055
0::/user.slice/user-1000.slice/us...@1000.service/app.slice/app-org.tigervnc.w0vncserver.service

Relevant log:

2026-07-14T01:25:14+08:00 Fennec systemd[752]: Stopping TigerVNC server for current KDE Wayland session...
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]: Tue Jul 14 01:25:14 2026
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager: Framebuffer updates: 239932
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:   Tight:
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:     Solid: 440.969 krects, 652.642 Mpixels
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:            6.72865 MiB (1:370.755 ratio)
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:     Bitmap RLE: 203.802 krects, 20.9077 Mpixels
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:                 4.90748 MiB (1:16.7273 ratio)
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:     Indexed RLE: 8.59139 Mrects, 1.66948 Gpixels
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:                  1.58832 GiB (1:3.9761 ratio)
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:   JPEG:
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:     Full Colour: 18.1304 Mrects, 81.3941 Gpixels
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:                  35.6795 GiB (1:8.50403 ratio)
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:   Total: 27.3666 Mrects, 83.7371 Gpixels
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  EncodeManager:          37.2791 GiB (1:8.37602 ratio)
2026-07-14T01:25:14+08:00 Fennec w0vncserver[9337]:  Connections: Closed: 10.89.41.131::9084
2026-07-14T01:25:14+08:00 Fennec systemd[752]: Stopped TigerVNC server for current KDE Wayland session.
2026-07-14T01:25:14+08:00 Fennec systemd[752]: app-org.tigervnc.w0vncserver.service: Consumed 11min 1.345s CPU time over 40min 48.633s wall clock time, 28M memory peak.
2026-07-14T01:25:14+08:00 Fennec systemd[752]: Started TigerVNC server for current KDE Wayland session.
2026-07-14T01:25:14+08:00 Fennec w0vncserver[13055]: Tue Jul 14 01:25:14 2026
2026-07-14T01:25:14+08:00 Fennec w0vncserver[13055]:  main:        Listening for VNC connections on all interface(s), port 5900
2026-07-14T01:25:26+08:00 Fennec w0vncserver[13055]: Tue Jul 14 01:25:26 2026
2026-07-14T01:25:26+08:00 Fennec w0vncserver[13055]:  Connections: Accepted: 10.89.41.131::49440
2026-07-14T01:25:26+08:00 Fennec w0vncserver[13055]:  SConnection: Client needs protocol version 3.8
2026-07-14T01:25:26+08:00 Fennec w0vncserver[13055]:  SConnection: Client requests security type VeNCrypt(19)
2026-07-14T01:25:26+08:00 Fennec w0vncserver[13055]:  SVeNCrypt:   Client requests security type TLSVnc (258)
2026-07-14T01:25:29+08:00 Fennec w0vncserver[13055]: Tue Jul 14 01:25:29 2026
2026-07-14T01:25:29+08:00 Fennec w0vncserver[13055]:  RemoteDesktop: Invalid restore token, not a valid UUID string
2026-07-14T01:25:29+08:00 Fennec w0vncserver[13055]:               "MIlt__KMFWHE_UA5Z5LcGQ"
2026-07-14T01:25:43+08:00 Fennec w0vncserver[13055]: Tue Jul 14 01:25:43 2026
2026-07-14T01:25:43+08:00 Fennec w0vncserver[13055]:  VNCSConnST:  Server default pixel format depth 24 (32bpp) big-endian rgb max
2026-07-14T01:25:43+08:00 Fennec w0vncserver[13055]:               255,255,255 shift 8,16,24

Thank you!

[Adam Halim]

On 13/07/2026 19:35, Foriz Fennec wrote:
> The XDG Desktop Portal RemoteDesktop interface documents restore_token as a
> string ("s"). I could not find a requirement that this string must use UUID
> format. Is the UUID-only validation intentional? Would it be appropriate
> for w0vncserver to treat the restore token as an opaque string instead
> of requiring uuid_parse() to succeed?
>
> Please also let me know if there is already a patch or development
> branch that
> I can test.

Yeah, there is no reason to validate the string. I've put up a PR [1]
that should fix this, let me know if this fixes it for you.

You could also try setting -RememberDisplayChoice=Never which should
bypass the check. If the app is pre-authorized, you shouldn't get a
dialog anyways. Haven't tested this thought so no promises there.

Thanks for the detailed report!

[1] https://github.com/TigerVNC/tigervnc/pull/2133

[Foriz Fennec]

Hello,

Thanks for the quick fix.

I tested PR #2133 directly from its PR branch at commit: 124937e86aaa292615ef5c058b200d6e4139463b

With -RememberDisplayChoice=Always, the first connection required one local approval. After that, I restarted the systemd user service and could reconnect
without any approval dialog. I also rebooted the entire machine and could connect again without local interaction.

The "Invalid restore token, not a valid UUID string" error is gone, so PR #2133 fixes the issue for me.

I also tested -RememberDisplayChoice=Never with the patched / unpatched versions both. It did not bypass the dialog in my environment; instead, local approval was requiredon every connection.

Thanks again!