I am using Services 3.X to make API calls in my Drupal installation. In order to update a user I:

  1. Make an API call to log in with an account which has rights to modify users (I'm using an admin account)
  2. Using the session I received from step 2, I make another API call to modify a user.

That works. My question is, should I have a step 3 and log out the account I used in step 1? The logout, of course will be done via the Services API. Would there be any bad side effects of not logging the account out?


  • i think you should have a step 3 and log out the account.
    – monymirza
    Feb 2, 2013 at 7:50

2 Answers 2


If you log the user out, the session ID that you received and used to modify users will expire, so it's recommended to do so.

I can imagine the following scenario:

You leave the user logged in. Someone else who have access to the server that you used to do the aforementioned actions somehow figures out the recently used session ID. They can use it to log in to your Drupal site within the maximum session lifetime.


Basically, if you don't need that user session anymore, then you should log the user out.

e.g something like:

curl http://example.com/services/user/logout -d "" -H "Cookie: SESS46e169b3ee0c2423dbf60ab06d25e9d7=9cc1a2cfa782d3d614a947a6a48066a0;" -v

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.