diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php
index 8b0149e..b8bfc41 100644
--- a/core/modules/user/src/AccountForm.php
+++ b/core/modules/user/src/AccountForm.php
@@ -128,7 +128,7 @@ public function form(array $form, FormStateInterface $form_state) {
       // one-time link and have the token in the URL. Store this in $form_state
       // so it persists even on subsequent Ajax requests.
       if (!$form_state->get('user_pass_reset')) {
-        $user_pass_reset = isset($_SESSION['pass_reset_' . $account->id()]) && Crypt::hashEquals($_SESSION['pass_reset_' . $account->id()], \Drupal::request()->query->get('pass-reset-token'));
+        $user_pass_reset = Crypt::hashEquals($this->getRequest()->getSession()->get('pass_reset_' . $account->id()), \Drupal::request()->query->get('pass-reset-token'));
         $form_state->set('user_pass_reset', $user_pass_reset);
       }
 
@@ -391,8 +391,6 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
     $user = $this->getEntity($form_state);
     // If there's a session set to the users id, remove the password reset tag
     // since a new password was saved.
-    if (isset($_SESSION['pass_reset_'. $user->id()])) {
-      unset($_SESSION['pass_reset_'. $user->id()]);
-    }
+    $this->getRequest()->getSession()->remove('pass_reset_' . $user->id());
   }
 }
diff --git a/core/modules/user/src/Form/UserPasswordResetForm.php b/core/modules/user/src/Form/UserPasswordResetForm.php
index 58f177f..866e6bd 100644
--- a/core/modules/user/src/Form/UserPasswordResetForm.php
+++ b/core/modules/user/src/Form/UserPasswordResetForm.php
@@ -108,7 +108,7 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
     drupal_set_message($this->t('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.'));
     // Let the user's password be changed without the current password check.
     $token = Crypt::randomBytesBase64(55);
-    $_SESSION['pass_reset_' . $user->id()] = $token;
+    $this->getRequest()->getSession()->set('pass_reset_' . $user->id(), $token);
     $form_state->setRedirect(
       'entity.user.edit_form',
       array('user' => $user->id()),