I have two Drupal sites set up. On site A, I'd like to authenticate myself as the currently logged-in user on site B (the remote site) so that I can view and edit nodes on the remote site using the Services module.

The two sites are on different domains, so I'm using the CORS module on the remote site. My CORS config is as follows:

*|http://MY-SITE-URL|*|Content-Type,X-CSRF-Token,Authentication, Origin, Cookie|true

Calling user/token against the remote site gets me a valid X-CSRF-Token. However, when I send the X-CSRF-Token with system/connect, the remote server returns the anonymous user.

I'm trying to authenticate against the remote server with the following code:

$base_url_api = variable_get('tnb_sync_base_url'); //URL of the remote server

            
            $options = array(
              'headers' => array(
                'Content-Type' => 'application/json',
              ),
              'method' => 'POST',
            );
            //Step 1: grab the authentication token from the remote server
            $response = drupal_http_request($base_url_api . '/user/token', $options);
            $data = json_decode($response->data);
                
            // Check if login was successful
            if ($response->code == 200) {
              // Now recycle the login cookie we received in the first request
              $options['headers']['X-CSRF-Token'] = $data->token;
              
              //Step 2: pass along the token and check who we're logged in as
              $response = drupal_http_request($base_url_api . '/system/connect', $options);
              $data = json_decode($response->data);
              
              kpr($response);
             
              return $options;
              
            }
            
            else {
                return NULL;
            }

The response for the system/connect call looks like:

stdClass Object
(
    [request] => POST /sync/system/connect HTTP/1.0
Content-Type: application/json
X-CSRF-Token: 74xWvd5I5l1ad1WmrIjqZoACo9r7f30YtJx_uCFot_g
X-NewRelic-ID: VQQAU1JbChACUldTBgUFVw==
X-NewRelic-Transaction: PxQBVFRUXQJUUVQGVQkFBVIEFB8EBw8RVU4aVA0KA1cCAQxUVQMLUAcAAkNKQQgKVVAEUgEEFTs=
User-Agent: Drupal (+http://drupal.org/)
Host: dev.tnb.plus
Content-Length: 0


    [data] => {"sessid":"7u8CZ98Gvb1P3ZuKSnK85g2FMkyu8OlqbOp8mnsy7OM","session_name":"SSESS4be586c0dc3085a3ca4f49c7acb4e7d1","user":{"uid":0,"hostname":"2001:4801:7827:0104:be76:4eff:fe11:ccd8","roles":{"1":"anonymous user"},"cache":0,"timestamp":1492095786}}
    [protocol] => HTTP/1.1
    [status_message] => OK
    [headers] => Array
        (
            [date] => Thu, 13 Apr 2017 15:03:06 GMT
            [content-type] => application/json
            [connection] => close
            [set-cookie] => __cfduid=dc62becfa48db03b7f5e40b426d0f587c1492095786; expires=Fri, 13-Apr-18 15:03:06 GMT; path=/; domain=.tnb.plus; HttpOnly
            [access-control-allow-credentials] => true
            [access-control-allow-origin] => http://dan-northern-portal.pantheonsite.io
            [cache-control] => no-cache, must-revalidate
            [expires] => Sun, 19 Nov 1978 05:00:00 GMT
            [surrogate-key] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
            [surrogate-key-raw] => 
            [vary] => Accept-Encoding, Accept
            [x-content-type-options] => nosniff
            [x-drupal-cache] => MISS
            [x-pantheon-endpoint] => a9463df4-67b3-47b9-ad41-148336613222
            [x-pantheon-styx-hostname] => styx94699a92
            [x-styx-req-id] => styx-e58976d158f4a1f2e669efc5205db167
            [x-styx-version] => StyxGo
            [xkey] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
            [x-varnish] => 952125076
            [age] => 0
            [via] => 1.1 varnish-v4
            [server] => cloudflare-nginx
            [cf-ray] => 34ef4f698acf2513-ORD
        )

    [code] => 200
)

How can I properly authenticate myself on the remote site using Services and CORS?