We have a Drupal 8 application that uses an event subscriber class to validate IP addresses against a table of white-listed addresses on kernel requests, and adds that value to a session variable. Basically, anonymous users with authenticated IPs can access privileged content on the site. I can use hook_node_access and hook_block_access to control access when appropriate, but hook_entity_field_access only fires once after rebuilding the caches, and not for each session, so field access seems more difficult to control this way. I've thought about injecting a service into my event subscriber and adding the necessary logic there for field access control, but I'm wondering if there's something easier that I'm missing about invalidating cache tags that would cause that hook to fire for each session.

1 Answer 1


I was able to use hook_entity_field_access and return an AccessResult $result->addCacheContexts(['session', 'user.roles.anonymous'])

  • Nice solution..
    – Jaypan
    Commented Feb 23, 2021 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.