2

Since the methods of the class will only work if the user is logged in, is it right or is there some problem that might make my code slow/inneficient?

2 Answers 2

2

I suggest you handle login separately (outside of your API class) and use PHP's session module to confirm the current session is authenticated.

6
  • -1 You don't know what language the OP is using.
    – Michael K
    Commented Jan 10, 2012 at 18:18
  • According to the OP's post tag, it's PHP.
    – sarumont
    Commented Jan 10, 2012 at 18:20
  • Hmm. Sorry, missed that. I'd cancel the downvote but it's locked in now.
    – Michael K
    Commented Jan 10, 2012 at 18:44
  • @Michael: If the answer is edited you can change your vote. Commented Jan 10, 2012 at 20:18
  • Edited to allow that. :)
    – sarumont
    Commented Jan 10, 2012 at 21:02
1

There's certainly nothing wrong with forcing your users to pass in credentials when they instantiate a copy of your service client, if that's what you want them to do.

However, you have to be careful. You can NEVER trust ANYTHING your consumers give you. So, say this is a web service, for which you are providing a service client API that just plugs in. You cannot be sure that the code that is calling your service is your service client, being used as you intended. Pretty much any communications protocol can be reverse-engineered as to its methodology and form, if not the exact data being sent in any given usage.

Therefore, if it is important for the user to be authenticated before doing anything else, I would check for authentication as the first step of any other task the service can perform. That does not preclude the development of a "login constructor", but it's an extra level of code security that protects you if a consumer should try to get around your implementation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.