How to avoid caching on access callbacks?
I did this using following way :

function my_custom_preprocess_page(&amp;$variables) {
  $url = Drupal\Core\Url::fromRoute('&lt;current&gt;');
  if ($url-&gt;getInternalPath() == 'my-view-page') {
    $password = \Drupal::config('my_custom.settings')-&gt;get('my_custom.pass');
    if (!isset($_SESSION['my_custom_pass']) || (isset($_SESSION['my_custom_pass']) &amp;&amp; $_SESSION['my_custom_pass'] != Crypt::hashBase64($password))) {
      throw new AccessDeniedHttpException();
    }
  }
}


Edit:
We can add our dependency to access object in our access hook.

/**
 * Implements hook_node_access().
 */
function my_custom_node_access(NodeInterface $node, $operation, AccountInterface $account) {
  $access = new AccessResultNeutral();
  $password = \Drupal::config('my_custom.settings')-&gt;get('my_custom.pass');
  if (!isset($_SESSION['my_custom_pass']) || (isset($_SESSION['my_custom_pass']) &amp;&amp; $_SESSION['my_custom_pass'] != Crypt::hashBase64($password))) {
    $access = new AccessResultForbidden();
  }
  $access-&gt;addCacheableDependency($_SESSION);
  return $access;
}