how could the global $user be different between the Drupal interface and Services module?

Question

If i do:

hook_node_view($node, $view_mode, $langcode) {
        global $user;
        var_dump($user);
        die();
        // i get the correct dump of the current pre-authorized user
}

HOWEVER, if I dump global $user from one of my public Service endpoints an anonymous user. That dump comes from a GET service resource defined as:

'retrieve' => array(
       'help' => 'Retrieves a note',
       'file' => array('file' => 'inc', 'module' => 'noteresource'),
       'callback' => '_noteresource_retrieve',
       'access callback' => '_noteresource_access',
       'access arguments' => array('view'),
       'access arguments append' => TRUE,
       'args' => array(
         array(
           'name' => 'id',
           'type' => 'int',
           'description' => 'The id of the note to get',
           'source' => array('path' => '0'),
           'optional' => FALSE,
         )
       )
     )

How could that be?

For my Drupal configuration: I am using LoginToboggan and Generate Password to handle registrations with only an email address. Alongside I am using the Services module which drives the API for our mobile app to tell the app if the user is logged in or not.

Under /admin/config/system/logintoboggan I have:

• I have "Set password" checked
• a "pre-authorize" permission selected for the "non-authenticated" role prior to email validation.
• I "never delete" unvalidated users
• I allow "immediate login" checked

Under /admin/config/people/accounts (regarding passwords), I have:

• Selected "Users may enter a password on registration. If left empty, a random password will be generated. This always applies when an administer is creating the account."
• Selected "Do not display" under generated password display.

The flow works well from the Drupal interface. That is, the registration is successful, the email is sent, and the user is logged immediately with the pre-authorize role applied even before validating their email. HOWEVER, my API endpoints still show that same user as anonymous users session when accessing it with global $user. I can literally reload the two pages as if there were no connection between them.

I have cleared all caches. I have weight-ordered the roles with pre-authorzed 2nd, after anonymous and before authenticated user I have verified the JS cookies are identical between the API page and Drupal interface (see the side by side comparison in the screenshots below) and that the $_SESSION globals shows nothing pre-authorized or more.

Is there another way I should access the pre-authorized user other than global $user?

Answer 1

Nice question! After reading your question. you are not logged in to your app because you are sending the anonymous requests after login. Workflow should be like this : 1)User register on the site.you will get the session id and session name. 2)Now need to set the session id and session name in headers then send the requests. you can check the same in drupal logs that whether your requests are coming from anonymous user or authenicated user. if drupal getting the requests from anonymous user then make sure that headers are properly set. See the services module documentation to learn out about this. Browser tools :

1. The Poster add-on for Firefox.
2. The REST Console app for Chrome.

if you are using the services module then take a look at its documentation