Inspecting HTTP headers when requesting a route generated from Views I have a content view with a REST Export display, and I want to inspect the HTTP request headers and look for a custom header, denying access to the view if the header's value is not on a whitelist. I was planning to use a hook called early in the view, like hook_views_pre_view(), and maybe some of the tools provided by Symfony's HttpFoundation to grab the request headers, but I'm not sure how to put all together. Any suggestions?
You can add a _custom_access requirement to any route via a custom RouteSubscriber extending off of RouteSubscriberBase. This requirement will add a method which can check the request headers to take action accordingly.

Define your event subscriber class in your mymodule.services.yml:

services:
  test.route_subscriber:
    class: Drupal\mymodule\Routing\MyRouteSubscriber
    tags:
      - { name: event_subscriber }


Within your src/Routing/MyRouteSubscriber.php class file extend RouteSubscriberBase with an alterRoutes(RouteCollection $collection) method:

namespace Drupal\mymodule\Routing;

use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;

/**
 * Listens to the dynamic route events.
 */
class MyRouteSubscriber extends RouteSubscriberBase {

  /**
   * {@inheritdoc}
   */
  public function alterRoutes(RouteCollection $collection) {

    // Add _custom_access to the my_view_machine_name REST export display
    if ($route = $collection-&gt;get('view.my_view_machine_name.rest_export_1')) {
      $route-&gt;setRequirement('_custom_access', '\Drupal\mymodule\Controller\MyCustomAccessController::access');
    }
  }
}


Within your src/Controller/MyCustomAccessController.php class file, perform the AccessResultlogic:

namespace Drupal\mymodule\Controller;

use Drupal\Core\Access\AccessResult;
use Drupal\Core\Session\AccountInterface;
use Symfony\Component\HttpFoundation\Request;

/**
 * Custom controller adds additional checks to REST data export view.
 */
class MyCustomAccessController {

  /**
   * Checks access for a specific request.
   *
   * @param \Drupal\Core\Session\AccountInterface $account
   *   Run access checks for this account.
   */
  public function access(AccountInterface $account) {
    $allowed = FALSE;
    $request = \Drupal::request();
    // @TODO: Add logic based off of $request-&gt;headers.
    return AccessResult::allowedIf($allowed);
  }
}