403 page starts a session for every anonymous visitor, which bypasses the page cache

Problem/Motivation

CustomErrorController::index() runs $_SESSION['destination'] = $_GET['destination']; on every 403. For an anonymous visitor that starts a session and sets a session cookie. Core's page cache skips any request that carries a session cookie, so after one 403 that visitor never gets a page cache hit again. Bots hit 403s all the time. On our site, 6,244 of the 6,330 anonymous sessions from one day held this value.

Nothing reads it. Core already adds the destination to the 403 subrequest itself in DefaultExceptionHtmlSubscriber::makeSubrequest(). The $_GET['destination'] writes next to it do nothing either, because Drupal reads query values from the Request object, which exists before the controller runs. Writing to $_SESSION directly is also deprecated in Drupal 11.2 and unsupported in 12 (change record).

#3440389: Allow disabling destination redirection after login noticed the caching cost and asks for a setting to turn this off. Since nothing reads the value, the block can go.

Steps to reproduce

1. Set the 403 page to /customerror/403.
2. As an anonymous visitor with no cookies, request a page you can't access.
3. The response sets a session cookie, and the sessions table has a new uid 0 row holding only destination.

Proposed resolution

Remove the destination block from the 403 branch of index().

!9 also adds enable_login to the config schema and the install config. #3241662: Add toggle button to show login form on error pages added the setting without schema, and a test can't turn the login form on without it.

Tests:

• An anonymous 403 sets no session cookie (fails on HEAD).
• Showing the login form on the 403 page sets no session cookie (fails on HEAD).
• A logged-in user keeps their session on a 403.