reverted:
--- b/core/lib/Drupal/Core/EventSubscriber/MaintenanceModeSubscriber.php
+++ a/core/lib/Drupal/Core/EventSubscriber/MaintenanceModeSubscriber.php
@@ -151,31 +151,11 @@
     ]);
   }
 
-  /**
-   * Check if the user has cookies enabled.
-   *
-   * If the user was redirected to this page on an attempted login but the
-   * login didn't succeed, warn them about missing cookies.
-   *
-   * @see \Drupal\user\Form\UserLoginForm::submitForm()
-   * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event
-   *   The event to process.
-   */
-  public function onKernelCheckUserCookies(GetResponseEvent $event) {
-    /** @var \Symfony\Component\HttpFoundation\Request $request */
-    $request = $event->getRequest();
-    if ($request->query->get('state') == 'loggedin' && $this->account->isAnonymous()) {
-      $domain = ini_get('session.cookie_domain') ? ltrim(ini_get('session.cookie_domain'), '.') : $request->server->get('HTTP_HOST');
-      $this->messenger->addMessage($this->t('To log in to this site, your browser must accept cookies from the domain %domain.', ['%domain' => $domain]), 'error');
-    }
-  }
-
   /**
    * {@inheritdoc}
    */
   public static function getSubscribedEvents() {
     $events[KernelEvents::REQUEST][] = ['onKernelRequestMaintenance', 30];
-    $events[KernelEvents::REQUEST][] = ['onKernelCheckUserCookies'];
     $events[KernelEvents::EXCEPTION][] = ['onKernelRequestMaintenance'];
     return $events;
   }
reverted:
--- b/core/modules/system/src/Tests/Session/SessionHttpsTest.php
+++ a/core/modules/system/src/Tests/Session/SessionHttpsTest.php
@@ -132,12 +132,7 @@
 
     // Follow the location header.
     $path = $this->getPathFromLocationHeader(FALSE);
+    $this->drupalGet($this->httpUrl($path));
-    $parsed_path = parse_url($path);
-    $query = [];
-    if (isset($parsed_path['query'])) {
-      parse_str($parsed_path['query'], $query);
-    }
-    $this->drupalGet($this->httpUrl($parsed_path['path']), ['query' => $query]);
     $this->assertResponse(200);
   }
 
@@ -177,12 +172,7 @@
 
     // Follow the location header.
     $path = $this->getPathFromLocationHeader(TRUE);
+    $this->drupalGet($this->httpsUrl($path));
-    $parsed_path = parse_url($path);
-    $query = [];
-    if (isset($parsed_path['query'])) {
-      parse_str($parsed_path['query'], $query);
-    }
-    $this->drupalGet($this->httpsUrl($parsed_path['path']), ['query' => $query]);
     $this->assertResponse(200);
   }
 
diff -u b/core/modules/user/src/Plugin/Block/UserLoginBlock.php b/core/modules/user/src/Plugin/Block/UserLoginBlock.php
--- b/core/modules/user/src/Plugin/Block/UserLoginBlock.php
+++ b/core/modules/user/src/Plugin/Block/UserLoginBlock.php
@@ -4,13 +4,12 @@
 
 use Drupal\Component\Utility\UrlHelper;
 use Drupal\Core\Access\AccessResult;
-use Drupal\Core\Block\BlockBase;
 use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
 use Drupal\Core\Routing\RedirectDestinationTrait;
 use Drupal\Core\Routing\RouteMatchInterface;
-use Drupal\Core\Routing\UrlGeneratorTrait;
-use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Url;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Block\BlockBase;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 
 /**
@@ -24,7 +23,6 @@
  */
 class UserLoginBlock extends BlockBase implements ContainerFactoryPluginInterface {
 
-  use UrlGeneratorTrait;
   use RedirectDestinationTrait;
 
   /**
only in patch2:
unchanged:
--- a/core/core.services.yml
+++ b/core/core.services.yml
@@ -1221,7 +1221,7 @@ services:
     class: Drupal\Core\EventSubscriber\AnonymousUserResponseSubscriber
     tags:
       - { name: event_subscriber }
-    arguments: ['@current_user']
+    arguments: ['@current_user', '@messenger']
   ajax_response.attachments_processor:
     class: Drupal\Core\Ajax\AjaxResponseAttachmentsProcessor
     tags:
only in patch2:
unchanged:
--- a/core/lib/Drupal/Core/EventSubscriber/AnonymousUserResponseSubscriber.php
+++ b/core/lib/Drupal/Core/EventSubscriber/AnonymousUserResponseSubscriber.php
@@ -4,8 +4,11 @@
 
 use Drupal\Core\Cache\CacheableMetadata;
 use Drupal\Core\Cache\CacheableResponseInterface;
+use Drupal\Core\Messenger\MessengerInterface;
 use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
+use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\HttpKernel\KernelEvents;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
@@ -14,6 +17,8 @@
  */
 class AnonymousUserResponseSubscriber implements EventSubscriberInterface {
 
+  use StringTranslationTrait;
+
   /**
    * The current user.
    *
@@ -22,13 +27,21 @@ class AnonymousUserResponseSubscriber implements EventSubscriberInterface {
   protected $currentUser;
 
   /**
+   * The messenger service.
+   *
+   * @var \Drupal\Core\Messenger\MessengerInterface
+   */
+  protected $messenger;
+
+  /**
    * Constructs an AnonymousUserResponseSubscriber object.
    *
    * @param \Drupal\Core\Session\AccountInterface $current_user
    *   The current user.
    */
-  public function __construct(AccountInterface $current_user) {
+  public function __construct(AccountInterface $current_user, MessengerInterface $messenger) {
     $this->currentUser = $current_user;
+    $this->messenger = $messenger;
   }
 
   /**
@@ -66,6 +79,25 @@ public function onRespond(FilterResponseEvent $event) {
   }
 
   /**
+   * Check if the user has cookies enabled.
+   *
+   * If the user was redirected to this page on an attempted login but the
+   * login didn't succeed, warn them about missing cookies.
+   *
+   * @see \Drupal\user\Form\UserLoginForm::submitForm()
+   * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event
+   *   The event to process.
+   */
+  public function onKernelCheckUserCookies(GetResponseEvent $event) {
+    /** @var \Symfony\Component\HttpFoundation\Request $request */
+    $request = $event->getRequest();
+    if ($request->query->get('state') == 'loggedin' && $this->currentUser->isAnonymous()) {
+      $domain = ini_get('session.cookie_domain') ? ltrim(ini_get('session.cookie_domain'), '.') : $request->server->get('HTTP_HOST');
+      $this->messenger->addMessage($this->t('To log in to this site, your browser must accept cookies from the domain %domain.', ['%domain' => $domain]), 'error');
+    }
+  }
+
+  /**
    * Registers the methods in this class that should be listeners.
    *
    * @return array
@@ -76,6 +108,7 @@ public static function getSubscribedEvents() {
     // event subscribers that add the associated cacheability metadata (which
     // have priority 10). This one is conditional, so must run after those.
     $events[KernelEvents::RESPONSE][] = ['onRespond', 5];
+    $events[KernelEvents::REQUEST][] = ['onKernelCheckUserCookies'];
     return $events;
   }
 
only in patch2:
unchanged:
--- a/core/modules/system/tests/src/Functional/Session/SessionHttpsTest.php
+++ b/core/modules/system/tests/src/Functional/Session/SessionHttpsTest.php
@@ -154,7 +154,12 @@ protected function loginHttp(AccountInterface $account) {
 
     // Follow the location header.
     $path = $this->getPathFromLocationHeader($response, FALSE);
-    $this->drupalGet($this->httpUrl($path));
+    $parsed_path = parse_url($path);
+    $query = [];
+    if (isset($parsed_path['query'])) {
+      parse_str($parsed_path['query'], $query);
+    }
+    $this->drupalGet($this->httpUrl($parsed_path['path']), ['query' => $query]);
     $this->assertResponse(200);
   }
 
@@ -200,7 +205,12 @@ protected function loginHttps(AccountInterface $account) {
 
     // Follow the location header.
     $path = $this->getPathFromLocationHeader($response, TRUE);
-    $this->drupalGet($this->httpsUrl($path));
+    $parsed_path = parse_url($path);
+    $query = [];
+    if (isset($parsed_path['query'])) {
+      parse_str($parsed_path['query'], $query);
+    }
+    $this->drupalGet($this->httpUrl($parsed_path['path']), ['query' => $query]);
     $this->assertResponse(200);
   }