I am trying to understand when exactly the last access time is set in the Drupal user login workflow. I did notice that the following method is probably what is used to set the timestamp

  public function setLastLoginTime($timestamp) {
    $this->get('login')->value = $timestamp;
    return $this;

However, I could only find the declaration but not the method call in the codebase and it has proven difficult to track it. It seems quite surprising it is not called anywhere. I am thinking that there should be a direct write to the field 'access'.

P.S The reason I am trying to get the value is to determine what all nodes are created after the user had last accessed the site.

  • 1
    login and access are two different fields. The former is updated on login, the latter every 180 sec when the user is accessing the site.
    – 4uk4
    Commented Jun 8, 2020 at 19:18
  • 1
    @4k4 – Do you know where for instance this happens? setLastAccessTime is only called in tests. There must be a different method then.
    – leymannx
    Commented Jun 8, 2020 at 19:21
  • 1
    @leymannx, this is an event subscriber UserRequestSubscriber::onKernelTerminate
    – 4uk4
    Commented Jun 8, 2020 at 19:25

1 Answer 1


Simply scan the codebase for setLastLoginTime and you'll see that there's actually only one single place where this function gets called. And that is user_login_finalize.

 * Finalizes the login process and logs in a user.
 * The function logs in the user, records a watchdog message about the new
 * session, saves the login timestamp, calls hook_user_login(), and generates a
 * new session.
 * The current user is replaced with the passed in account.
 * @param \Drupal\user\UserInterface $account
 *   The account to log in.
 * @see hook_user_login()
function user_login_finalize(UserInterface $account) {

And when does user_login_finalize get called? Scan the codebase again. And you'll see that there are some few places only. For example in the submit handler of the user login form, in the submit handler of the user register form, or for example also in the install_finished handler when you after a successful interactive site installation (in the browser) get logged in as user 1.

Following the input from @4k4 there must be differentiated between the last login time and the last access time. Both are base fields of the user entity. The login time gets stored on every login finalize (see above) and the access time (the one you can see in the users View in the LAST ACCESS column at /admin/people) gets renewed every 180 seconds. This happens in an event subscriber which gets triggered on every request/response cycle – the UserRequestSubscriber.

The last access time then can be retrieved from User::getLastAccessedTime. I maintain a small module to calculate online, absent and offline states of a user with exactly that method: https://git.drupalcode.org/project/user_online_status/-/blob/8.x-1.0/src/StatusService.php#L83.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.