On osTicket v1.18.2+, after a user/agent session expires, login often fails until browser cookies are cleared. This is a known session-cookie problem related to SameSite=None. There is still no official upstream patch; this is the community fix recommended by osTicket staff (KevinTheJedi).
Manual fix
File: include/class.ostsession.php
Function: renewCookie()
Find:
'samesite' => !empty($ost->getConfig()->getAllowIframes()) ? 'None' : 'Strict'
Replace with:
'samesite' => !empty($ost->getConfig()->getAllowIframes()) ? 'Lax' : 'Strict'
Optional but recommended — also update destroyCookie() so logout clears the cookie with the same SameSite value:
Replace the whole destroyCookie() method with:
static function destroyCookie() {
global $ost;
$opts = [
'expires' => 1,
'path' => ini_get('session.cookie_path'),
'domain' => ini_get('session.cookie_domain'),
'secure' => ini_get('session.cookie_secure'),
'httponly' => ini_get('session.cookie_httponly'),
'samesite' => ($ost && $ost->getConfig()
&& !empty($ost->getConfig()->getAllowIframes())) ? 'Lax' : 'Strict',
];
setcookie(session_name(), 'deleted', $opts);
}
After deploying
Upload the updated include/class.ostsession.php.
Ask affected users to clear cookies one last time (or delete the OSTSESSID cookie).
Log in again and confirm re-login works after session timeout.
Alternative (no code change)
Disable / clear Allow System iFrames in Admin → Settings → System,
or
Ensure HTTPS is used and PHP has session.cookie_secure = 1.
