Should I log the user out after calling an API using the Services module?

Question

I am using Services 3.X to make API calls in my Drupal installation. In order to update a user I:

1. Make an API call to log in with an account which has rights to modify users (I'm using an admin account)
2. Using the session I received from step 2, I make another API call to modify a user.

That works. My question is, should I have a step 3 and log out the account I used in step 1? The logout, of course will be done via the Services API. Would there be any bad side effects of not logging the account out?

Thanks.

Answer 1

If you log the user out, the session ID that you received and used to modify users will expire, so it's recommended to do so.

I can imagine the following scenario:

You leave the user logged in. Someone else who have access to the server that you used to do the aforementioned actions somehow figures out the recently used session ID. They can use it to log in to your Drupal site within the maximum session lifetime.

Answer 2

Basically, if you don't need that user session anymore, then you should log the user out.

e.g something like:

curl http://example.com/services/user/logout -d "" -H "Cookie: SESS46e169b3ee0c2423dbf60ab06d25e9d7=9cc1a2cfa782d3d614a947a6a48066a0;" -v