Login stopped working on 8.x-1.5 - 404 redirect not found

Problem/Motivation

In Drupal 10, I have updated to 8.x-1.5. When I login, I enter my details, but the callback URL gets a 404 not found

https://energistics-staging.vpn.opengroup.org/openid-connect/generic?sta...

So I can not log in.

Steps to reproduce

In Drupal 10, update from 1.4 to 1.5, and then try to log in

Proposed resolution

I have asked Claude! And the response was,

The actual issue is that the session is not being saved before the redirect. In 1.4 this wasn't a problem, but in 1.5 the pageCacheKillSwitch approach means the session write depends on the kernel response cycle completing properly.
The fix is to explicitly save the session in UserController::login(). Edit the file:
bashnano /var/www/energistics-staging.org/web/modules/custom/og_openid_connect/src/Controller/UserController.php
Change the login() method to save the session before returning:
phppublic function login() {
  if (\Drupal::currentUser()->isAuthenticated()) {
    return $this->redirect('<front>');
  }
  $this->session->saveDestination();
  $client_name = 'generic';

  $configuration = $this->config('openid_connect.settings.' . $client_name)
    ->get('settings');
  $client = $this->pluginManager->createInstance(
    $client_name,
    $configuration
  );
  $scopes = $this->claims->getScopes($client);
  $_SESSION['openid_connect_op'] = 'login';
  $response = $client->authorize($scopes);

  // Explicitly save the session so the state token is persisted
  // before the redirect to the IdP.
  $request = \Drupal::request();
  $request->getSession()->save();

  return $response;
}
Then clear caches:
bash./vendor/drush/drush/drush cr
This ensures $_SESSION['openid_connect_state'] (written by stateToken->create() inside authorize()) is actually persisted to the session store before the browser is redirected to the IdP and comes back.

Remaining tasks

User interface changes

API changes

Data model changes