I have two Drupal sites set up. On site A, I'd like to authenticate myself as the currently logged-in user on site B (the remote site) so that I can view and edit nodes on the remote site using the Services module.

The two sites are on different domains, so I'm using the CORS module on the remote site. My CORS config is as follows:

*|http://MY-SITE-URL|*|Content-Type,X-CSRF-Token,Authentication, Origin, Cookie|true

Calling user/token against the remote site gets me a valid X-CSRF-Token. However, when I send the X-CSRF-Token with system/connect, the remote server returns the anonymous user.

I'm trying to authenticate against the remote server with the following code:

$base_url_api = variable_get('tnb_sync_base_url'); //URL of the remote server

            $options = array(
              'headers' => array(
                'Content-Type' => 'application/json',
              'method' => 'POST',
            //Step 1: grab the authentication token from the remote server
            $response = drupal_http_request($base_url_api . '/user/token', $options);
            $data = json_decode($response->data);

            // Check if login was successful
            if ($response->code == 200) {
              // Add the token to the request headers:
              $options['headers']['X-CSRF-Token'] = $data->token;

              //Step 2: pass along the token and check who we're logged in as
              $response = drupal_http_request($base_url_api . '/system/connect', $options);
              $data = json_decode($response->data);


              return $options;


            else {
                return NULL;

The response for the system/connect call looks like:

stdClass Object
    [request] => POST /sync/system/connect HTTP/1.0
Content-Type: application/json
X-CSRF-Token: 74xWvd5I5l1ad1WmrIjqZoACo9r7f30YtJx_uCFot_g
User-Agent: Drupal (+http://drupal.org/)
Host: dev.tnb.plus
Content-Length: 0

    [data] => {"sessid":"7u8CZ98Gvb1P3ZuKSnK85g2FMkyu8OlqbOp8mnsy7OM","session_name":"SSESS4be586c0dc3085a3ca4f49c7acb4e7d1","user":{"uid":0,"hostname":"2001:4801:7827:0104:be76:4eff:fe11:ccd8","roles":{"1":"anonymous user"},"cache":0,"timestamp":1492095786}}
    [protocol] => HTTP/1.1
    [status_message] => OK
    [headers] => Array
            [date] => Thu, 13 Apr 2017 15:03:06 GMT
            [content-type] => application/json
            [connection] => close
            [set-cookie] => __cfduid=dc62becfa48db03b7f5e40b426d0f587c1492095786; expires=Fri, 13-Apr-18 15:03:06 GMT; path=/; domain=.tnb.plus; HttpOnly
            [access-control-allow-credentials] => true
            [access-control-allow-origin] => http://dan-northern-portal.pantheonsite.io
            [cache-control] => no-cache, must-revalidate
            [expires] => Sun, 19 Nov 1978 05:00:00 GMT
            [surrogate-key] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
            [surrogate-key-raw] => 
            [vary] => Accept-Encoding, Accept
            [x-content-type-options] => nosniff
            [x-drupal-cache] => MISS
            [x-pantheon-endpoint] => a9463df4-67b3-47b9-ad41-148336613222
            [x-pantheon-styx-hostname] => styx94699a92
            [x-styx-req-id] => styx-e58976d158f4a1f2e669efc5205db167
            [x-styx-version] => StyxGo
            [xkey] => AuKS06yStxtoXZf2mZvq kFG3DJ+3z7Lu2WK6wNkS
            [x-varnish] => 952125076
            [age] => 0
            [via] => 1.1 varnish-v4
            [server] => cloudflare-nginx
            [cf-ray] => 34ef4f698acf2513-ORD

    [code] => 200

How can I properly authenticate myself on the remote site using Services and CORS?


1 Answer 1


You just haven't logged in to the remote site yet; you can do that with something like:

$options['headers']['X-CSRF-Token'] = $data->token;
$options['method'] = 'POST';

$post_data = ['username' => 'foo', 'password' => 'bar'];
$options['data'] = drupal_http_build_query($post_data);

$response = drupal_http_request($base_url_api . '/user/login', $options);
$data = json_decode($response->data);

Assuming a successful login, subsequent requests within the session timeout will be made in the context of that user.

  • Thanks for the reply, @Clive. However, I thought calling user/token would automatically return the authentication token for the currently logged-in user. I've used that function call before to do just that (albeit without any cross-origin stuff). Apr 13, 2017 at 15:32
  • Yep, that's exactly what it does - it returns the auth token for the user based on the current session. Don't forget it's the current session on the remote site, not the current session on the site that's making the request. One knows nothing about the sessions of the other; you need to establish the session on the remote site separately, and the only way to do that with the services module is by logging in through user/login
    – Clive
    Apr 13, 2017 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.