I'm currently working on a custom module with an access form and set permissions for anonymous users.

I'm trying to make it so that when an anonymous user enters the password in the access form, they are logged successfully into 'node/3.'

The trick is, 'node/3' and any other basic page node is blocked for anonymous users via the following code I placed in my .MODULE file.

use Drupal\node\NodeInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Access\AccessResult;
function cookie_authentication_node_access(NodeInterface $node, $op, AccountInterface $account) {
if ($account->isAnonymous() && $node->gettype() == 'page') {
return AccessResult::forbidden()->cachePerPermissions();

return AccessResult::neutral();

Now, how do I get the anonymous user to access the page only for the condition that the password is entered in the access form?

Here's the code for the access form:

* @file
* Contains \Drupal\resume\Form\CookieForm.
namespace Drupal\cookie_authentication\Form;
use Drupal\Core\Form\FormBase;
use Drupal\Core\Form\FormStateInterface;
use Drupal\Core\Url;
class CookieForm extends FormBase {
   * {@inheritdoc}
  public function getFormId() {
    return 'cookie_authentication';
   * {@inheritdoc}
  public function buildForm(array $form, FormStateInterface $form_state)       {
     $form['password'] = array(
      '#type' => 'textfield',
      '#title' => t('Access'),
      '#required' => TRUE,

    $form['actions']['#type'] = 'actions';
    $form['actions']['submit'] = array(
      '#type' => 'submit',
      '#value' => $this->t('Submit'),
      '#button_type' => 'primary',
    return $form;
   * {@inheritdoc}

    public function validateForm(array &$form, FormStateInterface  $form_state) {
        $values = $form_state->getValue('password');
        //$configValue =  $config->get('access');
        $configValue = \Drupal::config('cookie_authentication.settings')->get('access');
         if ($values != $configValue) {
            $form_state->setErrorByName('password', $this->t('This value is not valid!'));

   * {@inheritdoc}
  public function submitForm(array &$form, FormStateInterface $form_state) {
    $password = $form_state->getValue('password');
    setcookie("password", $password );
    drupal_set_message('valid code');
    $response = Url::fromUserInput('/node/3');



The password is loaded through a config form I built into the back-end...

1 Answer 1


You can store a value on the session if the password match and then check that value:

$_SESSION['password_match'] = TRUE;

Or even better, as suggested by @4k4 you can do it the D8 way.

CookieForm class:

$session = $this->getRequest()->getSession();
$session->set('password_match', TRUE);


$password_match = \Drupal::request()->getSession()->get('password_match');
  • +1, session is a good idea, but the usage of this super global is deprecated and is probably removed in D9. Use the request to access the session, see drupal.stackexchange.com/a/236493/47547
    – 4uk4
    Oct 18, 2019 at 18:46
  • I agree that getting the session from the request object, the service or the container is a best practice and better in general for name spacing reasons, testing, etc... But $_SESSION comes from PHP, Drupal 8 just wraps the Symfony Session API which wraps the PHP global object. So I don't think 'is deprecated and is probably removed in D9' is accurated.
    – sam711
    Oct 21, 2019 at 16:18
  • You are right, unlike other superglobals it's still safe to use $_SESSION in D8, but it is officially deprecated. See this change record drupal.org/node/2380327. When I've started with Drupal 8 $_SESSION was still used in core in a lot of places, but they are step-by-step converted, see drupal.org/node/2473875
    – 4uk4
    Oct 21, 2019 at 16:29
  • Thanks! I updated my answer accordingly. Although nitpick, I still don't think that 'it's officially deprecated' is exactly right. I'd say that the code in core where $_SESSION is used has been deprecated and will be replaced.
    – sam711
    Oct 21, 2019 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.