1

What is the best way to tell if a user is already logged in when accessing the page? I have seen many people talk about a Recognition service that will validate a user trying to login, but what about checking if they're already logged in? Assuming I'm storing the user's state in the session, how do I check for this? My application also requires a whitelist. On top of that, I need to redirect the user to a 403 page if they aren't in the whitelist, as opposed to the login page, or whatever page they requested if they are logged in.

My main roadblocks are:

  • Where to implement whitelist logic? Router, domain object?
  • Check if user is logged in? Controller?
  • How to get current user's role if they are logged in for my ACL? Do I call the Recognition service in my index.php and have my Recognition service return the user or their role and pass that along to the acl for the controller to use?

Note: I'm not really fond of the Controller Decorator because if the user can't access the method in the controller, how and where is that handled?

  • 1
    You say you are using session management already. I do not understand what is missing: you are already tracking that user between page loads, what else would you need? – user22815 May 19 '15 at 0:37
  • @Snowman Sorry for the confusion, what I meant is that I "want" to store the user's state in the session, but I'm not sure where the best place is to have the logic of doing so (router, controller, domain object, etc). – GreeKatrina May 19 '15 at 13:19
2

Most likely, your MVC already includes a variable accessible within the controller for accessing the user's information. If you store user roles in the database, you can restrict access to certain areas of the site in the router based on role, or on a page-by-page/controller class-by-controller class basis. Whitelisting should probably happen in the front controller, or the bootstrap file.

1

Using PHP you would access the current user SessionToken cookie stored when you authenticated the user to check if:

  1. There is one present
  2. It has not passed its expiry
  3. It is the current token for that user stored in a session database

I would implement this by writing the code in a separate file/module and include it into each page of your project or main controller. Run the appropriate logic on checking these details.

All users need to be stored somewhere, the ideal location is on a database of some kind which will store if they can be logged in (whitelisted/blacklisted), their details and their sessionID.

  • My whitelist is composed of certain ip ranges that are allowed. [ '12.34.5.0/24', '11.22.3.0/24' ] for example. Are you suggesting this logic lie in some sort of Front Controller? Is the SessionToken you suggested stored in the database, or do you actually store the sessionID? – GreeKatrina May 19 '15 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.