Site stuck in 'headers have already been sent' login loop after D9 upgrade

Suggestions for debugging a site which is now stuck in a "headers have already been sent" loop after successful login (redirect back to login form)?

This is a production server for a site that's just been upgraded to Drupal 9. Session handling is absolutely fine on the development server so I'm sceptical about it being whitespace, closing tag issue (my one custom module is fine).

• Comparing against default.settings.php, I can't see anything obviously wrong with the settings.php file.
• Trusted sites array is set correctly.
• There's a valid temp directory (/tmp)
• All packages (Debian 10.11, Nginx, PHP 7.4, MariaDB, memcached) up to date.
• Restarted all the services. Restarted the server.
• No pending drush updates.
• The status report (before I logged out) was fine.
• Tried disabling the tfa/ga_login modules, no difference.
• upgrade_status was 100% ready before I did the D8->9 upgrade.
• I've run composer upgrade on production as well to look for any differences.
• Same PHP version on dev and production.

Any other ideas? (Anything in Drupal config I ought to look at, as there are likely to be differences between the two machines - config split etc.)

Thanks…

RuntimeException: Failed to start the session because headers have already been sent by "/var/www/sitename/vendor/symfony/http-foundation/Response.php" at line 384. in Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage->start() (line 152 of /var/www/sitename/vendor/symfony/http-foundation/Session/Storage/NativeSessionStorage.php) #0 /var/www/sitename/web/core/lib/Drupal/Core/Session/SessionManager.php(162): Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage->start()
#1 /var/www/sitename/web/core/lib/Drupal/Core/Session/SessionManager.php(193): Drupal\Core\Session\SessionManager->startNow()
#2 /var/www/sitename/vendor/symfony/http-foundation/Session/Session.php(189): Drupal\Core\Session\SessionManager->save()
#3 /var/www/sitename/web/core/lib/Drupal/Core/StackMiddleware/Session.php(60): Symfony\Component\HttpFoundation\Session\Session->save()
#4 /var/www/sitename/web/core/lib/Drupal/Core/StackMiddleware/KernelPreHandle.php(47): Drupal\Core\StackMiddleware\Session->handle()
#5 /var/www/sitename/web/core/modules/page_cache/src/StackMiddleware/PageCache.php(106): Drupal\Core\StackMiddleware\KernelPreHandle->handle()
#6 /var/www/sitename/web/core/modules/page_cache/src/StackMiddleware/PageCache.php(85): Drupal\page_cache\StackMiddleware\PageCache->pass()
#7 /var/www/sitename/web/core/lib/Drupal/Core/StackMiddleware/ReverseProxyMiddleware.php(47): Drupal\page_cache\StackMiddleware\PageCache->handle()
#8 /var/www/sitename/web/core/lib/Drupal/Core/StackMiddleware/NegotiationMiddleware.php(52): Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle()
#9 /var/www/sitename/vendor/stack/builder/src/Stack/StackedHttpKernel.php(23): Drupal\Core\StackMiddleware\NegotiationMiddleware->handle()
#10 /var/www/sitename/web/core/lib/Drupal/Core/DrupalKernel.php(717): Stack\StackedHttpKernel->handle()
#11 /var/www/sitename/web/index.php(19): Drupal\Core\DrupalKernel->handle()
#12 {main}.

Fixed by using composer install --no-dev, as I should have originally, which removed a lot of unnecessary packages. Unclear which of them would have broken it.

It's not that, it's this bug with the redirect_after_login module, for which there's a patch.

I thought I'd fixed it after getting rid of the dev packages, but I was getting confused because I used a one-time link (generated by drush user) which worked, and I could navigate freely and remain logged in.

The cookies were OK in that case, as redirect_after_login seemingly doesn't get called for one time links. I looked through the module list, saw it, realised I hadn't tried uninstalling it, did so and then checked the issue queue…

Also worth mentioning: should you uninstall the TFA module and later need to reinstall it, you'll need to grab the relevant rows from your backup of users_data (module=tfa) to reinstall people's seeds, saved one time codes etc.