0

I need some session verification code to be run on each request to Drupal. The most obvious solution that I have found was to use the EventSubscriber interface, and the KernelEvents::REQUEST event. However, it looks like this event is not fired when a cached page is displayed (though I did set the priority to 28, to bypass the dynamic page cache), which seems like a major issue when it comes to session verification.

I then tried another method: using the HttpKernel interface, as stack middleware, like the page cache itself, and as this page suggests.

However, this way the code appears to be executed before everything else, including access to session storage (not 100% sure). For example, this:

$uid = \Drupal::currentUser()->id();
\Drupal::logger('my_module')->info('Request for user: ' . $uid); 

Outputs: Request for user: 0, for any user (including admin) and in any situation. The PrivateTempStore doesn't work either.

Which method can I use to always be able to execute code that has access to the current user's session and related storage?

4
  • You don't need to bypass the Internal Page Cache because requests with a user session are not cached. If you subscribe to KernelEvents::REQUEST with a priority below 300 you should be able to access the user id. – 4k4 Dec 19 '19 at 12:50
  • In that case, how is it possible that sometimes I have a session, refresh the page and the event isn't fired? Is it possible that my user session no longer exists, but the links on the site still say Logout? (I would check the DB but this situation is difficult to reproduce). Thanks! – Ynhockey Dec 19 '19 at 12:52
  • This is the key to the question, how to reproduce this behavior. This would be a critical issue, because the internal page cache doesn't vary by session and if it stored such pages it would deliver content from one user to all other users. – 4k4 Dec 19 '19 at 13:10
  • Ok I will ask to close and then re-open this answer if new evidence is found. – Ynhockey Dec 19 '19 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.