I have a fresh install of Drupal 8.6.13, default everything with no custom themes or modules. It was created via:

drupal-composer/drupal-project:8.x-dev with the drupal site:new command.

When I use a one time login link I get a 403 access denied error because the session data (timestamp and hash) gets lost on the redirect from UserController::resetPass to UserController::getResetPassForm.

Here is the source code for reference: https://api.drupal.org/api/drupal/core%21modules%21user%21src%21Controller%21UserController.php/8.6.x

When I log the session variables when they are created in resetPass they are stored and show correctly.

When I then log the session variables on getResetPassForm they are no longer there. This causes the following code to execute which returns the 403:

if (!$hash || !$timestamp) {
  throw new AccessDeniedHttpException();

I'm not sure if this is a Drupal problem or Symfony problem or what.

Everything has worked fine on previous versions of Drupal 8.6.x. I noticed the issue when upgrading from 8.6.8 to 8.6.13. I have now tested with just a fresh install of 8.6.13 and am seeing this issue.

Server is Nginx.

Any ideas?

  • It's probably something server-/environment- specific, I've done hundreds of D8 installs from 8.0 up to 8.6.13 all over the place and I've never seen that particular error. Have you tried running anything other than Drupal on that PHP instance to make sure PHP sessions are working in general?
    – Clive
    Apr 4, 2019 at 14:13

1 Answer 1


This is an issue with symfony/http-foundation v3.4.24. See https://www.drupal.org/project/drupal/issues/3045844.

  • 1
    A temporary fix is composer require symfony/http-foundation:3.4.23 Apr 6, 2019 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.