"Session Expired" when logging in with Remember Me enabled

[CobreDev]

Lychee version

v7.5.1

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.4

Detailed description of the problem

When logging in to my Lychee instance, it works fine as long as "Remember Me" is not checked. If I check that option, it gives me this error:

Reloading takes me back to the same login screen, where I can log in fine as long as Remember Me is unchecked.

Steps to reproduce the issue

1. Open Lychee webui
2. Enter credentials
3. Check "Remember me"
4. Log in

Diagnostics [REQUIRED]

Self-diagnosis:

Info: Hash: 28509de3b36e81b0—e1be5215593a29be
2729 files and 14586 vendor files
Info: Full directory permission check is disabled
Warning: You may experience problems when uploading a photo of large size. Take a look in the FAQ for details.
upload_max_filesize is set to 20M
recommended is at least 30M
Info: Latest version of PHP is 8.5
Warning: opcache_get_configuration() is not available.
We are unable to check for performance optimizations.
Info: Have you considered supporting Lychee? :)

Info:

Lychee Version (release): 7.5.1
DB Version: 7.5.1

Docker: linuxserver.io
composer install: --no-dev
APP_ENV: production
APP_DEBUG: false
APP_URL: set
APP_DIR: default
LOG_VIEWER_ENABLED: true

System: Linux
PHP Version: 8.4.16
PHP User agent: Lychee/6 (https://lycheeorg.dev/)
Timezone: America/New_York
Max uploaded file size: 20M
Max post size: 200M
Chunk size: 12.80 MB
Max execution time: 200
SQLite Version: 3.49.2

exec() Available: yes
Imagick Available: 1
Imagick Enabled: yes
Imagick Version: 1810
GD Version: bundled (2.1.0 compatible)
Number of foreign key: 32 found.

Config:

version: 070501
check_for_updates: 0
sorting_photos_col: title
sorting_photos_order: ASC
sorting_albums_col: max_taken_at
sorting_albums_order: ASC
imagick: 1
skip_duplicates: 0
small_max_width: 0
small_max_height: 360
medium_max_width: 1920
medium_max_height: 1080
lang: en
image_overlay_type: none
default_license: CC-BY-NC-ND-4.0
compression_quality: 90
grants_full_photo_access: 1
delete_imported: 0
mod_frame_enabled: 0
mod_frame_refresh: 30
thumb_2x: 1
small_2x: 1
medium_2x: 1
landing_page_enable: 0
search_public: 0
hide_version_number: 0
recent_age: 1
grants_download: 0
photos_wraparound: 1
map_display: 1
zip64: 1
map_display_public: 0
map_provider: OpenStreetMap.org
map_include_subalbums: 0
update_check_every_days: 3
has_exiftool: 1
share_button_visible: 0
import_via_symlink: 0
has_ffmpeg: 1
location_decoding: 1
location_decoding_timeout: 30
location_show: 1
location_show_public: 0
rss_enable: 0
rss_recent_days: 7
rss_max_items: 100
prefer_available_xmp_metadata: 0
editor_enabled: 1
lossless_optimization: 0
local_takestamp_video_formats: .avi|.mov
log_max_num_line: 1000
unlock_password_photos_with_url_param: 0
nsfw_visible: 0
nsfw_blur: 0
nsfw_warning: 0
nsfw_warning_admin: 0
nsfw_banner_override:
map_display_direction: 1
album_subtitle_type: takedate
upload_processing_limit: 4
new_photos_notification: 0
zip_deflate_level: 6
default_album_protection: inherit
album_decoration: layers
album_decoration_orientation: row
allow_username_change: 1
auto_fix_orientation: 1
random_album_id: highlighted
use_last_modified_date_when_no_exif_date: 0
layout: justified
date_format_photo_thumb: M j, Y, G:i:s
date_format_photo_overlay: M j, Y, G:i:s
date_format_sidebar_uploaded: M j, Y, G:i:s
date_format_sidebar_taken_at: M j, Y, G:i:s
date_format_hero_min_max: F Y
date_format_hero_created_at: M j, Y, G:i:s
date_format_album_thumb: M Y
upload_chunk_size: 0
nsfw_banner_blur_backdrop: 0
search_pagination_limit: 300
search_minimum_length_required: 3
photo_layout_justified_row_height: 320
photo_layout_masonry_column_width: 300
photo_layout_grid_column_width: 250
photo_layout_square_column_width: 200
photo_layout_gap: 12
display_thumb_album_overlay: always
display_thumb_photo_overlay: never
default_album_thumb_aspect_ratio: 3/2
use_album_compact_header: 1
back_button_enabled: 0
back_button_text: Return to Home
SA_random_thumbs: 0
login_required: 0
enable_unsorted: 1
enable_highlighted: 0
enable_recent: 0
enable_on_this_day: 0
login_required_root_only: 1
dark_mode_enabled: 1
low_quality_image_placeholder: 1
show_keybinding_help_popup: 1
show_keybinding_help_button: 1
disable_se_call_for_actions: 0
enable_se_preview: 0
slideshow_timeout: 5
keep_original_untouched: 1
timeline_photos_enabled: 1
timeline_photos_public: 0
timeline_photos_granularity: day
timeline_photos_order: taken_at
timeline_photos_layout: masonry
timeline_photos_pagination_limit: 200
timeline_albums_enabled: 1
timeline_albums_public: 0
timeline_albums_granularity: year
timeline_left_border_enabled: 1
timeline_photo_date_format_year: Y
timeline_photo_date_format_month: M Y
timeline_photo_date_format_day: j M Y
timeline_photo_date_format_hour: g:i
timeline_album_date_format_year: Y
timeline_album_date_format_month: M Y
timeline_album_date_format_day: j M
hide_nsfw_in_smart_albums: 1
hide_nsfw_in_frame: 1
hide_nsfw_in_map: 1
hide_nsfw_in_search: 1
search_photos_layout: masonry
hide_nsfw_in_rss: 1
hide_nsfw_in_timeline: 1
number_albums_per_row_mobile: 3
cache_enabled: 0
cache_ttl: 86400
low_number_of_shoots_per_day: 10
medium_number_of_shoots_per_day: 50
high_number_of_shoots_per_day: 100
maintenance_processing_limit: 5000
disable_recursive_permission_check: 1
exif_disabled_for_all: 0
file_name_hidden: 0
default_old_settings: 0
default_expert_settings: 0
default_all_settings: 0
client_side_favourite_enabled: 0
disable_thumb_download: 1
disable_thumb2x_download: 1
disable_small_download: 0
disable_small2x_download: 0
disable_medium_download: 0
disable_medium2x_download: 0
temporary_image_link_enabled: 0
temporary_image_link_when_logged_in: 0
temporary_image_link_when_admin: 0
temporary_image_link_life_in_seconds: 86400
secure_image_link_enabled: 0
SA_override_visibility: 0
TA_override_visibility: 0
enable_colour_extractions: 0
colour_extraction_driver: farzai
home_page_default: gallery
timeline_page_enabled: 1
timeline_quick_access_date_format_year: Y
timeline_quick_access_date_format_month: M
timeline_quick_access_date_format_day: j M
timeline_quick_access_date_format_hour: h M, g:i
flow_enabled: 0
flow_public: 0
flow_base:
flow_max_items: 10
flow_strategy: auto
flow_include_sub_albums: 0
flow_include_photos_from_children: 0
flow_open_album_on_click: 0
flow_display_open_album_button: 0
flow_highlight_first_picture: 1
flow_min_max_enabled: 1
flow_display_statistics: 1
flow_compact_mode_enabled: 1
flow_image_header_enabled: 1
flow_image_header_cover: cover
flow_image_header_height: 24
flow_carousel_enabled: 1
flow_carousel_height: 6
date_format_flow_published: M j, Y, g:i:s A e
date_format_flow_min_max: F Y
flow_blur_nsfw_enabled: 1
hide_nsfw_in_flow: 1
skip_duplicates_early: 1
sync_delete_missing_photos: 0
sync_delete_missing_albums: 0
sync_dry_run: 1
gallery_header_enabled: 0
gallery_header_logged_in_enabled: 0
gallery_header:
gallery_header_bar_transparent: 1
gallery_header_bar_gradient: 1
import_via_url_forbidden_localhost: 1
import_via_url_forbidden_local_ip: 1
import_via_url_require_https: 1
import_via_url_forbidden_ports: 1
details_links_enabled: 0
details_links_public: 0
is_scroll_to_navigate_photos_enabled: 0
is_swipe_vertically_to_go_back_enabled: 1
photo_thumb_tags_enabled: 0
hide_nsfw_in_tag_albums: 1
hide_nsfw_in_tag_listing: 1
sorting_pinned_albums_col: created_at
sorting_pinned_albums_order: DESC
copyright_text:
watermark_enabled: 0
watermark_photo_id:
watermark_public: 1
watermark_logged_in_users_enabled: 0
renamer_enabled: 0
renamer_enforced: 0
renamer_enforced_before: 0
renamer_enforced_after: 0
renamer_photo_title_enabled: 1
renamer_album_title_enabled: 1
extract_zip_on_upload: 1
webshop_currency: EUR
webshop_default_description: No description provided.
webshop_allow_guest_checkout: 1
webshop_terms_url:
webshop_privacy_url:
webshop_default_price_cents: 0
webshop_default_license: personal
webshop_default_size: medium
enable_untagged: 0
photos_pagination_limit: 500
deduplicate_pinned_albums: 0
desktop_dock_full_transparency_enabled: 0
mobile_dock_full_transparency_enabled: 0
import_via_url_block_redirect: 1
enable_smart_album_per_owner: 0
rating_enabled: 1
rating_public: 0
rating_show_only_when_user_rated: 0
rating_show_avg_in_details: 1
rating_photo_view_mode: hover
rating_show_avg_in_photo_view: 0
rating_album_view_mode: hover
rating_show_avg_in_album_view: 1
album_layout: grid
albums_per_page: 30
albums_pagination_ui_mode: infinite_scroll
albums_infinite_scroll_threshold: 10
photos_per_page: 100
photos_pagination_ui_mode: infinite_scroll
photos_infinite_scroll_threshold: 10
enable_propagate_unlock_option: 0
shared_albums_visibility_default: show
enable_unrated: 0
enable_1_star: 0
enable_2_stars: 0
enable_3_stars: 0
enable_4_stars: 0
enable_5_stars: 0
enable_best_pictures: 1
best_pictures_count: 100
enable_photo_details_always_open: 0
enable_my_rated_pictures: 0
enable_my_best_pictures: 1
my_best_pictures_count: 50
gps_coordinate_display: 1
gps_coordinate_display_public: 0
photos_star_visibility: editor
album_enhanced_display_enabled: 0
album_header_size: half_screen
album_header_landing_title_enabled: 0
watermark_optout_disabled: 0
raw_download_enabled: 0
contact_form_enabled: 0
contact_form_security_question:
contact_form_security_answer:
contact_form_custom_consent_required: 0
contact_form_custom_privacy_url:
contact_form_header:
contact_form_headline:
contact_form_contact_method:
contact_form_message_label:
contact_form_message_answer:
contact_form_custom_consent_text:
contact_form_custom_submit_button_text:
contact_form_thank_you_message:
landing_background_landscape_mode: static
landing_background_portrait_mode: static
search_colour_distance: 30

Browser & System [REQUIRED]

Safari 26.3.1 on macOS 26.3.1

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[ildyria]

Thank you for the report I will double check that.

[CobreDev]

Forgot to note, I'm running this through docker using lscr.io/linuxserver/lychee:latest if this helps narrow it down

[ildyria]

Lychee Version (release): 7.5.1
DB Version: 7.5.1

Docker: linuxserver.io
composer install: --no-dev
APP_ENV: production

Yes, it is in the diagnostic 😄

[ildyria]

@CobreDev sorry for the delayed response. I am currently unable to reproduce your issue.
Can you tell me more about your session setup ?

SESSION_DRIVER=file
SESSION_LIFETIME=120
SESSION_SECURE_COOKIE=false

[CobreDev]

@ildyria happy to answer anything I can…though most of it is basically how it came set up. I don’t recall ever changing (or frankly even seeing) those three session settings. Let me know if there’s anything else I can answer!

[ildyria]

That is so weird. I'll pull the linux.io image to double check if that could be the reason.

[CobreDev]

sounds good, let me know if you need anything!

[jiaope]

Yes, I encountered the same problem. I also installed the service via Docker. After installation, this problem occurs when I click "remember me" to log in; otherwise, I can log in normally.

[jiaope]

Hello, I've identified the problem. It wasn't related to Lychee; it was due to an incorrect nginx configuration. After modifying my nginx configuration, it worked. I apologize for taking up your time, thank you.

[CobreDev]

that’s good to hear! What was the misconfiguration? Maybe my issue is the same cause

[ildyria]

I apologize for taking up your time, thank you.

None needed. :)

[jiaope]

that’s good to hear! What was the misconfiguration? Maybe my issue is the same cause

Hello, this is my modified nginx configuration file. The sections commented out with "new add" are configuration sections added during the fix. Since this was an AI-driven fix, I'm not sure which section specifically took effect. You can compare it with your original configuration file.

# new add
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    server_name wall.ex.com; 
    
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/wall.ex.com/fullchain.pem; # managed by Certbot 
    ssl_certificate_key /etc/letsencrypt/live/wall.ex.com/privkey.pem; # managed by Certbot 
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options SAMEORIGIN;
    add_header Referrer-Policy strict-origin-when-cross-origin;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    client_max_body_size 300m;
    client_body_buffer_size 128k;
    client_body_timeout 600s;
    send_timeout 600s;
    
    proxy_connect_timeout 60s;
    proxy_read_timeout 600s;
    proxy_send_timeout 600s;

    location / {
        proxy_pass http://127.0.0.1:9090;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # new add
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;

        # new add
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_request_buffering off;
        proxy_buffering off;

        # new add
        proxy_buffer_size 128k;
        proxy_buffers 4 256k;
        proxy_busy_buffers_size 256k;
    }

    location ~* \.(jpg|jpeg|png|gif|webp|avif|mp4|css|js|ico|svg|woff2)$ {
        proxy_pass http://127.0.0.1:9090;
        proxy_set_header Host $host;
        
        # new add
        proxy_buffer_size 128k;
        proxy_buffers 4 256k;
        proxy_busy_buffers_size 256k;

        expires 30d;
        add_header Cache-Control "public, no-transform";
        access_log off;
    }
}

server {
    if ($host = wall.ex.com) { 
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name wall.ex.com; 
    return 404; # managed by Certbot
}