0

I've just put together my first app using Zend_Authenticate. According to some tutorials I've read they store the user's "email" column. Is this recommended? I've read to store the ID only, then on each request fetch the user by ID. That way, only the ID is stored in the session. Is this recommended with Zend too?

Anyway here is my handling of user login, I'd appreciate any feedback. Basically I'm authenticating. If that passed, I then store the ID in auth storage and a custom flash message. The script then redirects to the homepage (upon which the login form will be replaced with a user panel - e.g. "Welcome back John" - and my flash message will display.

Below is my loginAction method:

public function loginAction()
{
  $form = new LoginForm();

  $form->get('submit')->setValue('Login');

  $request = $this->getRequest();

  if ($request->isPost()) {

      // check the users credentials and authenticate
      $this->getAuthService()
        ->getAdapter()
        ->setIdentity($request->getPost('email'))
        ->setCredential($request->getPost('password'));

      $result = $this->getAuthService()->authenticate();

      if ($result->isValid()) {

        // set the user id in storage
        $resultRow = $this->getAuthService()->getAdapter()->getResultRowObject();
        $this->getAuthService()->getStorage()->write($resultRow->id);

        // set flash messenger
        $this->flashMessenger()->addMessage('You are now logged in');

        // redirect to the home page
        return $this->redirect()->toUrl('/');
      }

  }

    return new ViewModel(array(
      'form' => $form,
    ));
  }

}
3

There isn't any "golden" rule here, just common sense:

  1. storing user-id is a minimum. If it works for you (see below) — great, no need to complicate the matters.
  2. storing additional information inside of session is nothing else but denormalization: you trade automatic consistency for speed. if you store enough information in session (display name, email, …) for generating some of the pages you won't need to query the whole user-object in a separate DB-query (speed!) but you will have to be sure to sync updated fields of profile between DB and the session (no more automatic consistency)

so, if speed benefit is important for you — give it a chance. otherwise — just store user-id

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.