Token issue

[mike-diamond]

I try to use com api as angular-resource, but I have one issue, Joomla doesn't allow me to log out, it returns me "Invalid token" on a white page and user doesn't log out.
I call to api without key, as I understand the plugin create a token if I do not use key as GET parameter.
When I use key generated for admin, joomla make automatically logging as admin after page refresh and without login-password input!
What I need to fix the problem?

[coolbung]

Hi Mike,

I believe you are seeing this since you are using the APIs in the browser. Due to the way the login is implemented, if you use the APIs in browser and then open the Joomla site the user will be shown as logged in. This happens since in the browser Joomla's session management triggers the session creation, so the user gets logged in.

The use cases that we've been using are largely to do with Mobile apps, so the session didnt pose an issue.

If you wish to fix this behavior you should look at changing the authentication code in the library
https://github.com/techjoomla/com_api/blob/master/code/site/libraries/authentication.php