Calling user/token and system/connect through CORS returns anonymous user

Question

I have two Drupal sites set up. On site A, I'd like to authenticate myself as the currently logged-in user on site B (the remote site) so that I can view and edit nodes on the remote site using the Services module.

The two sites are on different domains, so I'm using the CORS module on the remote site. My CORS config is as follows:

*|http://MY-SITE-URL|*|Content-Type,X-CSRF-Token,Authentication, Origin, Cookie|true

Calling user/token against the remote site gets me a valid X-CSRF-Token. However, when I send the X-CSRF-Token with system/connect, the remote server returns the anonymous user.

I'm trying to authenticate against the remote server with the following code:

$base_url_api = variable_get('tnb_sync_base_url'); //URL of the remote server


            $options = array(
              'headers' => array(
                'Content-Type' => 'application/json',
              ),
              'method' => 'POST',
            );
            //Step 1: grab the authentication token from the remote server
            $response = drupal_http_request($base_url_api . '/user/token', $options);
            $data = json_decode($response->data);

            // Check if login was successful
            if ($response->code == 200) {
              // Add the token to the request headers:
              $options['headers']['X-CSRF-Token'] = $data->token;

              //Step 2: pass along the token and check who we're logged in as
              $response = drupal_http_request($base_url_api . '/system/connect', $options);
              $data = json_decode($response->data);

              kpr($response);

              return $options;

            }

            else {
                return NULL;
            }

The response for the system/connect call looks like:

stdClass Object
(
    [request] => POST /sync/system/connect HTTP/1.0
Content-Type: application/json
X-CSRF-Token: 74xWvd5I5l1ad1WmrIjqZoACo9r7f30YtJx_uCFot_g
X-NewRelic-ID: VQQAU1JbChACUldTBgUFVw==
X-NewRelic-Transaction: PxQBVFRUXQJUUVQGVQkFBVIEFB8EBw8RVU4aVA0KA1cCAQxUVQMLUAcAAkNKQQgKVVAEUgEEFTs=
User-Agent: Drupal (+http://drupal.org/)
Host: dev.tnb.plus
Content-Length: 0


    [data] => {"sessid":"7u8CZ98Gvb1P3ZuKSnK85g2FMkyu8OlqbOp8mnsy7OM","session_name":"SSESS4be586c0dc3085a3ca4f49c7acb4e7d1","user":{"uid":0,"hostname":"2001:4801:7827:0104:be76:4eff:fe11:ccd8","roles":{"1":"anonymous user"},"cache":0,"timestamp":1492095786}}
    [protocol] => HTTP/1.1
    [status_message] => OK
    [headers] => Array
        (
            [date] => Thu, 13 Apr 2017 15:03:06 GMT
            [content-type] => application/json
            [connection] => close
            [set-cookie] => __cfduid=dc62becfa48db03b7f5e40b426d0f587c1492095786; expires=Fri, 13-Apr-18 15:03:06 GMT; path=/; domain=.tnb.plus; HttpOnly
            [access-control-allow-credentials] => true
            [access-control-allow-origin] => http://dan-northern-portal.pantheonsite.io
            [cache-control] => no-cache, must-revalidate
            [expires] => Sun, 19 Nov 1978 05:00:00 GMT
            [surrogate-key] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
            [surrogate-key-raw] => 
            [vary] => Accept-Encoding, Accept
            [x-content-type-options] => nosniff
            [x-drupal-cache] => MISS
            [x-pantheon-endpoint] => a9463df4-67b3-47b9-ad41-148336613222
            [x-pantheon-styx-hostname] => styx94699a92
            [x-styx-req-id] => styx-e58976d158f4a1f2e669efc5205db167
            [x-styx-version] => StyxGo
            [xkey] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
            [x-varnish] => 952125076
            [age] => 0
            [via] => 1.1 varnish-v4
            [server] => cloudflare-nginx
            [cf-ray] => 34ef4f698acf2513-ORD
        )

    [code] => 200
)

How can I properly authenticate myself on the remote site using Services and CORS?

Answer 1

You just haven't logged in to the remote site yet; you can do that with something like:

$options['headers']['X-CSRF-Token'] = $data->token;
$options['method'] = 'POST';

$post_data = ['username' => 'foo', 'password' => 'bar'];
$options['data'] = drupal_http_build_query($post_data);

$response = drupal_http_request($base_url_api . '/user/login', $options);
$data = json_decode($response->data);

Assuming a successful login, subsequent requests within the session timeout will be made in the context of that user.