If i do:

hook_node_view($node, $view_mode, $langcode) {
        global $user;
        // i get the correct dump of the current pre-authorized user

HOWEVER, if I dump global $user from one of my public Service endpoints an anonymous user. That dump comes from a GET service resource defined as:

'retrieve' => array(
       'help' => 'Retrieves a note',
       'file' => array('file' => 'inc', 'module' => 'noteresource'),
       'callback' => '_noteresource_retrieve',
       'access callback' => '_noteresource_access',
       'access arguments' => array('view'),
       'access arguments append' => TRUE,
       'args' => array(
           'name' => 'id',
           'type' => 'int',
           'description' => 'The id of the note to get',
           'source' => array('path' => '0'),
           'optional' => FALSE,

How could that be?

For my Drupal configuration: I am using LoginToboggan and Generate Password to handle registrations with only an email address. Alongside I am using the Services module which drives the API for our mobile app to tell the app if the user is logged in or not.

Under /admin/config/system/logintoboggan I have:

  • I have "Set password" checked
  • a "pre-authorize" permission selected for the "non-authenticated" role prior to email validation.
  • I "never delete" unvalidated users
  • I allow "immediate login" checked

Under /admin/config/people/accounts (regarding passwords), I have:

  • Selected "Users may enter a password on registration. If left empty, a random password will be generated. This always applies when an administer is creating the account."
  • Selected "Do not display" under generated password display.

The flow works well from the Drupal interface. That is, the registration is successful, the email is sent, and the user is logged immediately with the pre-authorize role applied even before validating their email. HOWEVER, my API endpoints still show that same user as anonymous users session when accessing it with global $user. I can literally reload the two pages as if there were no connection between them.

I have cleared all caches. I have weight-ordered the roles with pre-authorzed 2nd, after anonymous and before authenticated user I have verified the JS cookies are identical between the API page and Drupal interface (see the side by side comparison in the screenshots below) and that the $_SESSION globals shows nothing pre-authorized or more.

enter image description here enter image description here enter image description here

Is there another way I should access the pre-authorized user other than global $user?

  • your services endpoints configuration is very important here. what are they ? your services user will always be anon until they are logged in and have a valid cookie. Are you using the user login service first ? Commented Nov 18, 2014 at 19:44
  • @user1081275: my endpoint is /js-api/note/getme.json. Where basically i do noteresource_get_note($id='getme'){return $user}. Are cookies from Services separarte from the Drupal interface?
    – E.A.T
    Commented Nov 18, 2014 at 20:22

1 Answer 1


Nice question! After reading your question. you are not logged in to your app because you are sending the anonymous requests after login. Workflow should be like this : 1)User register on the site.you will get the session id and session name. 2)Now need to set the session id and session name in headers then send the requests. you can check the same in drupal logs that whether your requests are coming from anonymous user or authenicated user. if drupal getting the requests from anonymous user then make sure that headers are properly set. See the services module documentation to learn out about this. Browser tools :

  1. The Poster add-on for Firefox.
  2. The REST Console app for Chrome.

if you are using the services module then take a look at its documentation

  • thank you! I've posted a screenshot of two tabs comparing cookies. They have identical session IDs.
    – E.A.T
    Commented Nov 18, 2014 at 21:06
  • It seems to me that the cookies are going fine in both screenshots. In the function call back of this service /js-api/node/getme.json Make sure you are getting the proper uid corresponding to that session parameters ? Check in your function callback ? R u using services module ? Commented Nov 18, 2014 at 21:22
  • i am using the Services module. I've updated the question to include my resource definition
    – E.A.T
    Commented Nov 18, 2014 at 22:43
  • check the services call(by which user) on the drupal site by enabling the debugging in the service endpoint. Commented Nov 18, 2014 at 22:58
  • great point @Naveen, i have enabled debugging no the endpoint. However, still none of the services logs tell me anything alluding to an error or user's session.
    – E.A.T
    Commented Nov 19, 2014 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.