I have a fresh install of Drupal 8.6.13, default everything with no custom themes or modules. It was created via:
drupal-composer/drupal-project:8.x-dev with the drupal site:new command.
When I use a one time login link I get a 403 access denied error because the session data (timestamp and hash) gets lost on the redirect from UserController::resetPass to UserController::getResetPassForm.
Here is the source code for reference: https://api.drupal.org/api/drupal/core%21modules%21user%21src%21Controller%21UserController.php/8.6.x
When I log the session variables when they are created in resetPass they are stored and show correctly.
When I then log the session variables on getResetPassForm they are no longer there. This causes the following code to execute which returns the 403:
if (!$hash || !$timestamp) {
throw new AccessDeniedHttpException();
}
I'm not sure if this is a Drupal problem or Symfony problem or what.
Everything has worked fine on previous versions of Drupal 8.6.x. I noticed the issue when upgrading from 8.6.8 to 8.6.13. I have now tested with just a fresh install of 8.6.13 and am seeing this issue.
Server is Nginx.
Any ideas?
