Needs work
Project:
Drupal core
Version:
main
Component:
base system
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
27 Sep 2026 at 15:43 UTC
Updated:
27 Sep 2026 at 16:43 UTC
Jump to comment: Most recent
In FrankenPHP worker mode, requests reuse the kernel and services. AuthenticationSubscriber::onKernelRequestAuthenticate()sets the current account only when a provider returns one. If the provider returns nothing or an exception is thrown, the current_user proxy keeps the account from the previous request.
At the start of each main request, set the current user to anonymous before checking providers for each main request.
AI disclosure: I used AI to help prepare the IS and MR (Astra and Opus 5.5).
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
ptmkenny commentedAdding a draft MR for this but there is no test so I'm setting it to "Needs work." There may also be a better way to fix this...
Comment #4
ptmkenny commentedActually, thinking about this some more, it's probably better to call
AccountProxy::reset()during cleanup.