I have a Drupal 8.6.10 site which has a very confusing logout bug:
- I have a page that has various elements on it as images, js, css and so on.
- I load that page and everything works fine
- I add an image to that page
- I load the page again, everything fine, also the image is showing.
- I delete the source image and the image style derivatives of that image
- I reload the page -> I get logged out!
I can see on the call to the image (which returns a 404 because the image is not existing), the value of the SSESS Session cookie is changed (so the session ID) thus I'm losing the connection to my session and get logged out.
I have already proven that this happens inside the execution of PHP and has nothing to do with varnish (logging at the very end of index.php, before the answer gets sent, shows already the changed session id using
I have a parallel installation which is still on Drupal 8.3.7, and which contains various fixes of this issue: https://www.drupal.org/node/2743931 When I remove the fixes for the issue, the bug does no more appear.
However after the update to 8.6.10, I removed all the fixes because the issue has been fixed in core, and despite the fixes being removed, the logout bug still appears.
How can the session id even be changed? Calling
session_start() a second time does not work and
session_regenerate_id (the only one in the symfony core) is never called.
Please help me on this one, as I'm currently at the end of my latin. Thanks!