Sorry, I know it's weird, but I'm trying to integrate another php application with Drupal. I want to know if the user is currently logged in to the Drupal site, even though the request is going elsewhere. I'm getting the cookie out of a Guzzle request object. As far as the application is concerned (because of Nginx proxying), the origin is the same, and the cookie is getting passed successfully.

Here's what I'm getting out of the Guzzle request object:

array(1) {
  string(43) "5eW8YPdDPjojAjuokObuD5R2L7cyOfffmBuVAdHzWwU"

The above value is also what the browser reports.

But, in my sessions table in the DB, there is no session that resembles this, either in the sid or the session column.

How does Drupal check the DB for a valid session cookie, and where should I be looking in core to copy this?

  • 1
    Isn't \Drupal::currentUser()->isAuthenticated() insufficient for your use case? Why do you need to dig so deep into the code?
    – user21641
    Mar 19, 2017 at 11:55
  • 1
    Because I'm trying to integrate another PHP app with Drupal, and Drupal isn't bootstrapped. If I go out of my way to bootstrap Drupal, it reports that the current user is the anonymous user, even though I can grab the cookie manually out of the Guzzle request object. Mar 19, 2017 at 16:43

1 Answer 1


I figured it out, but if someone posts a more in-depth answer, I'll accept it.

Drupal has a SessionHandler with a read function:

public function read($sid) {
    $data = '';
    if (!empty($sid)) {
      // Read the session data from the database.
      $query = $this->connection
        ->queryRange('SELECT session FROM {sessions} WHERE sid = :sid', 0, 1, [':sid' => Crypt::hashBase64($sid)]);
      $data = (string) $query->fetchField();
    return $data;

And, if you bootstrap Drupal, or call an external Drush script, you can do this:

$session_handler = \Drupal::getContainer()->get('session_handler.storage');
$logged_in = (bool) $session_handler->read($session);

Here's how I got the cookie out of the Guzzle object:

foreach($cookies as $cookie){
  if(strpos($cookie, "SESS") == 0){
    $session = $cookie;

If you actually want the UID, you're going to have to not do the (bool) cast and de-blob the thing, because it returns the raw MySQL data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.