I have an external php application that currently uses Drupal services to authenticate users.
It's working fine but users frequently enter incorrect credentials and Drupal's flood control eventually blocks the IP of my application. And therefore every user that attempts to login to my application.
The plan to get around this is to have users log directly into Drupal and redirect them to the app. And if they go straight to the app it checks to see if the user is logged in via services. If not logged in then direct them to Drupal's login page.
As far as I can tell I should be able to use /system/connect.json to get the current user, but I keep getting anonymous user and not the user currently logged into the browser.
When I retrieve the X-CSRF-Token using a REST console browser extension via /services/session/token I get the correct token for the currently logged in user .. But getting the token through the app using php_curl I get an new token with every request.
Is it possible for me to determine if a user is logged into Drupal in the current browser via services not knowing who they are? Or am I going about this the wrong way?