node_load_multiple does not respect node access grants I used $nodes = node_load_multiple(NULL, array("title" =&gt; "Foo Bar")); to fetch nodes by titles. But after going through Drupal security standards, node_load_multiple is not the right way to load all nodes. 

node_load_multiple() will load ALL nodes regardless of access, so that must not be used here. 

Solution suggestion is:


  Use an entity query instead. "When adding a node listing to your
  module, be sure to use an entity query, which will add a tag of
  "node_access". This will allow modules dealing with node access to
  ensure only nodes to which the user has access are retrieved"


But I'm not sure how to apply above statement programmaticly? 

Is below query the right way that solves security issues?

\Drupal\node\Entity\Node::loadMultiple(NULL, array("title" =&gt; "Foo Bar"));


If not, please suggest an appropriate alternate of loading nodes by title that respects node access grants.
You can do it like this. First, query the NIDs, with a query that is tagged for node access, then load the nodes with the found NIDs.

$nids = db_select('node_field_data', 'n')
  -&gt;fields('n', ['nid'])
  -&gt;condition('title', $my_title)
  // The node_access tag will check access rights.
  -&gt;addTag('node_access')
  -&gt;execute()
  -&gt;fetchCol();

$nodes = Node::loadMultiple($nids);


Untested in D8, but it should work.