Same name and namespace in other branches
  1. 7.x modules/user/user.module \user_login_finalize()
  2. 8.9.x core/modules/user/user.module \user_login_finalize()
  3. 9 core/modules/user/user.module \user_login_finalize()

Finalizes the login process and logs in a user.

The function logs in the user, records a watchdog message about the new session, saves the login timestamp, calls hook_user_login(), and generates a new session.

The current user is replaced with the passed in account.

Parameters

\Drupal\user\UserInterface $account: The account to log in.

See also

hook_user_login()

\Drupal\user\Authentication\Provider\Cookie

1 call to user_login_finalize()
RegisterForm::save in core/modules/user/src/RegisterForm.php

File

core/modules/user/user.module, line 457
Enables the user registration and login system.

Code

function user_login_finalize(UserInterface $account) {
  \Drupal::currentUser()
    ->setAccount($account);
  \Drupal::logger('user')
    ->info('Session opened for %name.', [
    '%name' => $account
      ->getAccountName(),
  ]);

  // Update the user table timestamp noting user has logged in.
  // This is also used to invalidate one-time login links.
  $account
    ->setLastLoginTime(\Drupal::time()
    ->getRequestTime());
  \Drupal::entityTypeManager()
    ->getStorage('user')
    ->updateLastLoginTimestamp($account);

  // Regenerate the session ID to prevent against session fixation attacks.
  // This is called before hook_user_login() in case one of those functions
  // fails or incorrectly does a redirect which would leave the old session
  // in place.

  /** @var \Symfony\Component\HttpFoundation\Session\SessionInterface $session */
  $session = \Drupal::service('session');
  $session
    ->migrate();
  $session
    ->set('uid', $account
    ->id());
  $session
    ->set('check_logged_in', TRUE);
  \Drupal::moduleHandler()
    ->invokeAll('user_login', [
    $account,
  ]);
}