As your documentation says I have created a view-only user with a token and when using that token to show a widget I'm getting an error saying "This user has superuser access". It works if I load the same url while logged out or in another browser. Seems odd if it shouldn't work since this should be a fairly common case.

Example url: http://localhost:8000/index.php?module=Widgetize&action=iframe&forceView=1&disableLink=1&token_auth=xxx&moduleToWidgetize=VisitsSummary&actionToWidgetize=getEvolutionGraph&viewDataTable=graphEvolution&idSite=1&date=2021-02-09,2021-03-10&period=range

Expected Behavior

It should be possible to show the widget even if you are currently logged in as a super user in the same browser.

Current Behavior

Error message saying
"This user has super user access. For embedding widgets super user token auths are not allowed. See our faq for more information."

Possible Solution

I have tried to follow the code and it seems that when using the token_auth parameter there is a call to the method Request::reloadAuthUsingTokenAuth eventually landing in Access::reloadAccess, however it return without reloading since $this->hasSuperUserAccess is still true from the session auth.

Steps to Reproduce (for Bugs)

1. Create user with view permissions and generate a token
2. Create a widgetized url and add the token to the url
3. Load the url in a browser where you are logged in as a super user

Context

We are trying to embed widgets in an external dashboard.

Your Environment

I'm running your latest docker image.

• Matomo Version: 4.2.1