Wrong user page loaded after user_login_finalize()/user_logout()

Question

I have a third party login custom module that calls user_login_finalize() after authentication, and user_logout() upon logout. Both of these functionalities work except if the user logs in/out from the /user path in Drupal, the page loads the version of the /user page that should have rendered prior to login/logout. So when logging in, the page shows the unauthorized warning that was there at first, until the page is reloaded. When logging out, the page shows the user profile information that was there when the user was logged in.

This code runs in an event subscriber for KernelEvents::REQUEST (my organization's authentication works in a way that the status of whether a user is authenticated can change outside my Drupal site at any time and needs to be checked for before content is loaded).

I'm not sure if the problem has to do with the third party login redirecting, or Drupal's cache, but is there something else that needs to be cleared or reset after using these functions? I used them intentionally to avoid writing duplicate code from what's already in Drupal.

Answer 1

This code runs in an event subscriber for KernelEvents::REQUEST (my organization's authentication works in a way that the status of whether a user is authenticated can change outside my Drupal site at any time and needs to be checked for before content is loaded).

If the authentication status has changed then set a redirect response to built the new page after you have created a new session or destroyed the existing session via the user module functions you have mentioned:

$response = new RedirectResponse(Url::fromRoute('<current>')->toString());
$event->setResponse($response);