How does Drupal verify sessions from the cookie value?
I figured it out, but if someone posts a more in-depth answer, I'll accept it.

Drupal has a SessionHandler with a read function:

public function read($sid) {
    $data = '';
    if (!empty($sid)) {
      // Read the session data from the database.
      $query = $this-&gt;connection
        -&gt;queryRange('SELECT session FROM {sessions} WHERE sid = :sid', 0, 1, [':sid' =&gt; Crypt::hashBase64($sid)]);
      $data = (string) $query-&gt;fetchField();
    }
    return $data;
  }


And, if you bootstrap Drupal, or call an external Drush script, you can do this:

$session_handler = \Drupal::getContainer()-&gt;get('session_handler.storage');
$logged_in = (bool) $session_handler-&gt;read($session);


Here's how I got the cookie out of the Guzzle object:

$request-&gt;getCookies();
//var_dump($cookies);
foreach($cookies as $cookie){
  if(strpos($cookie, "SESS") == 0){
    $session = $cookie;
  }
}


If you actually want the UID, you're going to have to not do the (bool) cast and de-blob the thing, because it returns the raw MySQL data.