This is affecting both versions 3.22.19 and 4.2.7. It seems like I've been seeing this issue after LS v3.17.

I am getting several survey respondents who are getting either "your session has timed out" or "This token has already been used" when hitting Submit upon finishing their survey. The respondents say they are only in for anywhere between 1-30 minutes. According to our database, those tokens are successfully used and data recorded, but our respondents are angry that they believe their answers are not being recorded. We are not sure why this is happening.

FYI I have already tried changing the PHPSESSID cookie name.

I have two different installations in two different environments exhibiting the same problem:

SERVER 1:
Windows Server 2012 R2
Microsoft SQL Server 2016
IIS 8.5
PHP 7.3.4

SERVER 2:
Ubuntu 20.04
Apache 2
PHP 7.4.5
MariaDB 10.3

(FYI I've opened a ticket with LS Support)

FYI I've opened a ticket with LS Support

The ticket with LS Support will not get you anywhere, because they will only give you support for paid products (e.g. Limesurvey Pro hosting or the Comfort Update). As your installations are on your own server and this does not relate to Comfort Update in anyway, they most probably will direct you to the forum.

Now, with the problem description it is fairly hard to help. It does not seem to be a general problem, because we would have a lot more complaints here. So it must be something specific to your environment.

Now, given that it happens on two different servers with different setups (Windows vs Linux) it doesn't seem to necessarily be something server related. Though it could be due to the same PHP settings.

Is this with the same survey or are these different surveys?

What is strange is that there are different errors. Might be actually two different problems.

What is the session setting in PHP?

Is there any redirect or email notification upon submit?

What I find strange is that this happens in two totally different Versions, both in 3.x and 4.x. This makes me suspicious that it has nothing to do with Limesurvey itself, but rather with your setup, or your network.

This servers are setup where? In your offices (if so, are they accessible only via LAN or via the web as well)? In a data center?

I gotcha. This is with different surveys on two different systems, which is why this is so baffling. It happens on 1-question surveys and 8-question surveys. No redirect at the end / e-mail notifications at all. They are pretty basic surveys with tokens.

Here's my PHP settings, which are mostly out of the box.

It's very random and happens intermittently. It's perhaps less than 1% of the total respondents, but out of 150 or 2,000 respondents, that's still a good number of people. We weren't getting this issue before upgrading past 3.17, and I know there was a bug related to the cookie name for PHPSESSID, so I am at a loss. I did make that change in config.php:

since I was getting this issue after upgrading from 3.x to 4.x, but now it's showing up in 3.22 also.

Sorry, forgot to answer your other question: the Windows IIS box is setup on-prem. The other Linux Apache box is setup in the cloud on Vultr. Both are doing the same thing. It is weird.

They are publicly accessible servers to the Internet.

Please create a bug report, just in case. As it is happening on two different installations, with two different setups and different surveys, I think we can't discard a bug, even if it sounds not very likely to me personally.

And here it is! bugs.limesurvey.org/view.php?id=16382