vasike / services_auth_apikeys Goto Github PK

In _services_auth_apikeys_authenticate_call() call https://github.com/vasike/services_auth_apikeys/blob/7.x-1.x/services_auth_apikeys.inc#L46, you override global user by apikey user but do not set back previous user.
So after apikey authentication, it's the apikey user who will be authenticated, and not the current user.

Ex:
Some call to service, check authentication. User APIKEY is authenticated and approved.
Browser (or app) is authenticated as User APIKEY authenticated user.
User 10 wants to authenticate. It can't since it's already authenticated as user APIKEY. In any cases, _services_auth_apikeys_authenticate_call() will override the user by authenticated user.