I have an event(s) controller:

class Event extends CI_Controller{

   public function index(){

   public function foo(){

   //Shouldn't be able to use this method unless logged in
   public function bar(){


And I'm trying to organise my code so it's fairly tidy and straightforward. Just now I have a controller named MY_Controller so that only authenticated users can access the methods(edit_event(),add_event()) of any controllers extending it.

However, some of the methods in my controller need to be accessed by unauthenticated users (such as get_event()).

What is a good way of handling this? Should I make two completely separate controllers or extend from the basic event controller and add authenticated methods?

Previously I've had a manager controller that handled all methods which required authentication such as add_user,delete_user,add_doc,delete_doc. But it became blotted very quickly and wasn't easy to update or modify the controller (plus it was messy and didn't seem to follow good programming etiquette).

2 Answers 2


How about

public function bar() {
   if (notLoggedIn)
       // display error page
       // perform authorized action

OK, so it's not very sexy, certainly not as fancy as decorating the methods with some thing, but it does have the virtue of giving you full access to the database for authentication purposes, which is more than can be said for, say, the [Authorized] attribute in C#

  • So the Controller class needs to also have access to a notLoggedIn method or property or would this be like a Global Defined variable?
    – JasonDavis
    Commented Mar 25, 2013 at 23:54
  • 1
    It would be a method or property, most likely from a Repository object. The logic for permissions is part of your Model, not your Controller. Commented Mar 26, 2013 at 3:03
  • @Robert Harvey: While I generally agree with this statement, I always like to separate into domain logic and application logic. Imho handling authentication and logins is application logic for the domain and mostly not domain logic itself.
    – Falcon
    Commented Mar 26, 2013 at 17:13
  • @Falcon: OK. But if you're writing a backend that you want to be reusable with, say, WPF, wouldn't it be nice if the security logic were already there in your model? Commented Mar 26, 2013 at 17:14
  • @Robert Harvey: I have reusable application logic layers above my domain, completely independent of the presentation/service accessing it :-)
    – Falcon
    Commented Mar 26, 2013 at 17:17

In a medium to large project I separate the controllers. This keeps the implementation of each controller a bit cleaner. And since security should be a core concern, this ensures you never forget to explicitly check the user is logged in. Plus you can easily swap your security implementation later if it needs to change.

  • Right, have different controllers that are coded against the same interface!
    – Falcon
    Commented Mar 26, 2013 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.