I need some session verification code to be run on each request to Drupal. The most obvious solution that I have found was to use the EventSubscriber interface, and the
KernelEvents::REQUEST event. However, it looks like this event is not fired when a cached page is displayed (though I did set the priority to 28, to bypass the dynamic page cache), which seems like a major issue when it comes to session verification.
I then tried another method: using the HttpKernel interface, as stack middleware, like the page cache itself, and as this page suggests.
However, this way the code appears to be executed before everything else, including access to session storage (not 100% sure). For example, this:
$uid = \Drupal::currentUser()->id(); \Drupal::logger('my_module')->info('Request for user: ' . $uid);
Outputs: Request for user: 0, for any user (including admin) and in any situation. The PrivateTempStore doesn't work either.
Which method can I use to always be able to execute code that has access to the current user's session and related storage?