Password reset link is not working in drupal 8.6. The email with the one-time login link is sent just fine, but when the user clicks on the Login button, they get "You are not authorized to access this page" message. Even I tried to open user/reset/{id} with login as admin still same error. When I figuring out the issue I found one line in user.module line no 556 \Drupal::moduleHandler()->invokeAll('user_login', [$account]); is causing the issue. If I remove this line then I can reset my password successfully. whats this line is doing? Does it load all active modules in website? than there must be issue in any module. Could I remove this line? Any alter solution?

I tried by clearing cache,cookie, browser history, session table, also $cookie_domain = $_SERVER['HTTP_HOST']; this line is not in my settings.php

  • Take a backup of your site, then start disabling modules one at a time, and try the password reset in between each one, until you figure out which module is causing the problem.
    – Jaypan
    Commented Apr 16, 2019 at 14:09

3 Answers 3


whats this line is doing? Does it load all active modules in website?

It invokes a hook (hook_user_login), which other installed modules can respond to. It doesn't "load" any modules, but those other installed modules are already available at that point, yes.

Could I remove this line?

Physically, yes, but it would be a terrible idea. It's important, or it wouldn't be there.

Any alter solution?

You need to debug your site, preferably with a step-debugger like XDebug. Chances are you have a rogue custom or contributed module doing something it shouldn't be.

  • If it can help anybody my issue is I am redirecting user on some condition in my custom module which causing this issue
    – softech
    Commented Apr 16, 2019 at 13:44

Had similar outcome but issue was purely that the User record was still set to Blocked rather than Active.


This is an issue with symfony/http-foundation v3.4.24. See https://www.drupal.org/project/drupal/issues/3045844

Source: Drupal 8 dropping session variables on password reset. Gives 403 Access Denied

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.