User reset access denied (expected outcome of samesite: strict on session cookies)

Is it this? ✨ One-time login links broken in Gmail/Outlook Postponed: needs info

Please confirm whether you have samesite: strict set on session cookies.

Here is another one: 💬 When external link has a referrer, /user/login?destination= shows login screen when logged in Closed: works as designed .

the parameters was not there in the services.yml
it should be lax by default.

Anyway , adding

parameters:
  session.storage.options:
     # Set the SameSite cookie attribute: 'None', 'Lax', or 'Strict'. If set,
     # this value will override the server value. See
     # https://www.php.net/manual/en/session.security.ini.php for more
     # information.
     # @default no value
     cookie_samesite: Lax

seems indeed to fix it

is it safe to put lax then regarding CSRF vulnerabilities ?

You may have “strict” set in php.ini. Anyway, the setting is your decision: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#sam...