Checking if user is logged into Drupal from another php application using Drupal services and REST

Question

I have an external php application that currently uses Drupal services to authenticate users.

It's working fine but users frequently enter incorrect credentials and Drupal's flood control eventually blocks the IP of my application. And therefore every user that attempts to login to my application.

The plan to get around this is to have users log directly into Drupal and redirect them to the app. And if they go straight to the app it checks to see if the user is logged in via services. If not logged in then direct them to Drupal's login page.

As far as I can tell I should be able to use /system/connect.json to get the current user, but I keep getting anonymous user and not the user currently logged into the browser.

When I retrieve the X-CSRF-Token using a REST console browser extension via /services/session/token I get the correct token for the currently logged in user .. But getting the token through the app using php_curl I get an new token with every request.

Is it possible for me to determine if a user is logged into Drupal in the current browser via services not knowing who they are? Or am I going about this the wrong way?

Answer 1

I would recommend using OAuth2.0, check out OAuth 2.0, assuming Drupal 8, otherwise there's the OAuth 1.0 for Drupal 7 (or if you're not using SSL with D8 for some reason).

This is the same tech that Facebook and Google use when you want to let people log into your site/app using their 3rd party credentials, so it should be robust enough if I understood what you were asking.