Calling user/token and system/connect through CORS returns anonymous user
You just haven't logged in to the remote site yet; you can do that with something like:

$options['headers']['X-CSRF-Token'] = $data-&gt;token;
$options['method'] = 'POST';

$post_data = ['username' =&gt; 'foo', 'password' =&gt; 'bar'];
$options['data'] = drupal_http_build_query($post_data);

$response = drupal_http_request($base_url_api . '/user/login', $options);
$data = json_decode($response-&gt;data);


Assuming a successful login, subsequent requests within the session timeout will be made in the context of that user.