Redmine

Could you post the exact steps that should be followed to reproduce your issue?

Hello.
I have the same problem.
Have any solution over the last year?

And now?

I've had the same issue, and was able to track it down to a peculiar behaviour in Firefox. We are hosting our Redmine instance on redmine.company.tld, and I noticed that when I enabled the "Stay logged in" checkbox, Firefox would immediately lose the `_redmine_session` cookie after login, and would only keep the `autologin` cookie. Losing the `_redmine_session` cookie caused Redmine's CSRF validation to break because it relies on the session data. Not checking the "Stay logged in" checkbox didn't cause this behaviour, and opening Redmine in an incognito window also circumvented the problem completely.

The reason for this strange Cookie-losing behaviour was that I had visited hundreds of different BigBlueButton subdomains of company.tld in the past few years, which each stored one session cookie per subdomain, which Firefox's session restore feature permanently stored as a part of my session. This had caused Firefox to accumulate ~180 cookies for company.tld in total, which is the per-domain limit. Firefox therefore decided to evict cookies, and for some reason it prefers to evict `Secure: false` cookies first instead of evicting the least recently used cookie. Redmine's `_redmine_session` is `Secure: false`, while the `autologin` cookie is `Secure: true`, and therefore the `_redmine_session` cookie bit the dust.

I've posted the whole story here: https://bugzilla.mozilla.org/show_bug.cgi?id=1698289#c17

TLDR: if you want to figure out if you're affected by the same issue, install the https://addons.mozilla.org/de/firefox/addon/cookie-quick-manager/ extension and search for your domain (e.g. company.tld if your Redmine is hosted on redmine.company.tld). If there are several hundred subdomains listed, or a subdomain with several hundred cookies, clean that up to resolve the issue.