title: Drupal Services 3.x files upload to server right or wrong credentials
body: <p>I am trying to set up a REST web service in Drupal using Services 3.x module. The service allows me to upload a file with an apikey. I have tried the following methods to check valid apikey to permit upload request.</p>
  
  <p>1)check the apikey in the POST data during create process and upload happens.</p>
  
  <p>2)tried the <a href="https://drupal.org/project/services_api_key_auth" rel="nofollow">Services API Key Authentication</a> Module which implements the 
  hook_services_authentication_info() which checks for the apikey.  </p>
  
  <p>3)implemented hook_services_request_preprocess_alter($controller, &amp;$args, $options) to check for apikey both in POST headers as well as in the POST payload and it works.</p>
  
  <p>However, in all the above method the file is uploaded to the server (/tmp) regardless of right or wrong apikey. The request is denied once the apikey check happens in all three methods above. This is concerning as it opens the server for easy ddos . Is there a way to intercept the and check apikey before the file is uploaded to the server and deny the request when apikey is not valid?</p>
  
  <p>All my communication is over https so I would not like to go via session authentication mechanism.</p>
  
  <p>Could this be because of apache server settings?  If so, how to restrict  uploads to authenticated users?</p>
  
  <p>Please advise.</p>