Password reset link gives access denied

Question

Password reset link is not working in drupal 8.6. The email with the one-time login link is sent just fine, but when the user clicks on the Login button, they get "You are not authorized to access this page" message. Even I tried to open user/reset/{id} with login as admin still same error. When I figuring out the issue I found one line in user.module line no 556 \Drupal::moduleHandler()->invokeAll('user_login', [$account]); is causing the issue. If I remove this line then I can reset my password successfully. whats this line is doing? Does it load all active modules in website? than there must be issue in any module. Could I remove this line? Any alter solution?

I tried by clearing cache,cookie, browser history, session table, also $cookie_domain = $_SERVER['HTTP_HOST']; this line is not in my settings.php

Answer 1

whats this line is doing? Does it load all active modules in website?

It invokes a hook (hook_user_login), which other installed modules can respond to. It doesn't "load" any modules, but those other installed modules are already available at that point, yes.

Could I remove this line?

Physically, yes, but it would be a terrible idea. It's important, or it wouldn't be there.

Any alter solution?

You need to debug your site, preferably with a step-debugger like XDebug. Chances are you have a rogue custom or contributed module doing something it shouldn't be.

Answer 2

Had similar outcome but issue was purely that the User record was still set to Blocked rather than Active.

Answer 3

This is an issue with symfony/http-foundation v3.4.24. See https://www.drupal.org/project/drupal/issues/3045844

Source: Drupal 8 dropping session variables on password reset. Gives 403 Access Denied