Drupal 8 dropping session variables on password reset. Gives 403 Access Denied I have a fresh install of Drupal 8.6.13, default everything with no custom themes or modules. It was created via:

drupal-composer/drupal-project:8.x-dev with the drupal site:new command.

When I use a one time login link I get a 403 access denied error because the session data (timestamp and hash) gets lost on the redirect from UserController::resetPass to UserController::getResetPassForm.

Here is the source code for reference: https://api.drupal.org/api/drupal/core%21modules%21user%21src%21Controller%21UserController.php/8.6.x

When I log the session variables when they are created in resetPass they are stored and show correctly.

When I then log the session variables on getResetPassForm they are no longer there. This causes the following code to execute which returns the 403:

if (!$hash || !$timestamp) {
  throw new AccessDeniedHttpException();
}


I'm not sure if this is a Drupal problem or Symfony problem or what.

Everything has worked fine on previous versions of Drupal 8.6.x. I noticed the issue when upgrading from 8.6.8 to 8.6.13. I have now tested with just a fresh install of 8.6.13 and am seeing this issue.

Server is Nginx.

Any ideas?
This is an issue with symfony/http-foundation v3.4.24. See https://www.drupal.org/project/drupal/issues/3045844.