CodeIgniter User Authentication

Question

I have authenticated users using code igniter successfully, but now if users type in the route to one the methods in one of my controllers, they can access it without logging in.

I would like to stop this access to users which havent logged in preferably without using a 3rd party User Auth Plugin.

I have this model code:

function login(){
    $data = array(
        'username' => $this->input->post('username'),
        'logged_in' => TRUE
    );
    $this->session->set_userdata($data);
} //function login()
function logged_in(){
    if($this->session->userdata('logged_in') == TRUE)
    {
        return TRUE;
    }
    return FALSE;
} //function logged in()

I have this controller code:

    function index($condition = FALSE){
    if($this->admin_model->logged_in() === TRUE)
    {
        $this->books_page(TRUE);
    }
    else
    {
        $data = $this->style_model->admin_area();
        $data['page_intro'] = 'Oops! Sorry, you must be logged in to view this page.';
        $this->load->view('admin/not_logged_in', $data);
    }
} //function index()
    function books_page(){
        $data = $this->style_model->admin_area();
        $data['category_query'] = $this->admin_books_model->get_book_categories();
        $data['page_title'] = 'Books';
        $data['query'] = $this->admin_books_model->get_books();         
        $this->load->view('admin/books/books_admin', $data);
    }    //function books_page()

Users who have not logged in cannot access the books method but any other methods after this they can access, i simply want to stop that access and pass them the error page informing them that they have to login.

Thanks in advance, Tom

Just as a thought, you might consider getting into TankAuth for CodeIgniter. It's so secure and makes life very easy once you learn it. FWIW. — David
– David, Commented Sep 7, 2012 at 12:32

Mike Mackintosh · Accepted Answer · 2013-05-09 14:23:24Z

4

The best way is to split your logic into two (or more) controllers.

A 'front end' controller - where the user does not need to be logged in for ANY of it
A 'back end' controller(s) - where the user MUST be logged in for ALL of it

In your backend controller just do this

class Backend extends CI_Controller 
{
    public function  __construct()
    {
        parent::__construct();
        if( ! ($this->admin_model->logged_in())
        {
            // Not logged in - so force them away
            redirect ('place login page here');
       }
    }
 }

Then EVERYTHING in backend controller is protected.

To take this concept further - look into using a MY_Controller and get all your backend controllers to extend from this.

edited May 9, 2013 at 14:23

Mike Mackintosh

14.3k7 gold badges64 silver badges87 bronze badges

answered Sep 7, 2012 at 12:36

Laurence

60.3k22 gold badges178 silver badges215 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Tom Over a year ago

Hi everyone thank you for your help I really appreciate it, at first I tried the answer from Slave and this worked perfectly however I liked the idea of using the MY_Controller class (TheShiftExchange Answer) because it is more efficient and uses less code (not repeating). I did some research on this and now I have it working, thanks again everyone really appreciate it.

David · Accepted Answer · 2012-09-07 12:38:10Z

1

Either I misunderstood your question, or the solution is very simple.

function books_page() {
   if(!$this->admin_model->logged_in()) {
      redirect('auth/login'); ## OR $this->load->view("error_page"); exit();
   }
   ## All your code, etc.
}

answered Sep 7, 2012 at 12:38

David

3,8112 gold badges31 silver badges38 bronze badges

Comments

Slavenko Miljic · Accepted Answer · 2012-09-07 12:38:45Z

1

I would declare a variable on top of the controller like this:

private $logged_in = false;

Then in the constructor I would initialise it like so:

$this->logged_in = $this->session->userdata('logged_in');

Then you can disable the access to desired methods (or the complete controller if you put your check in the constructor):

if($this->logged_in)
{
   //do stuff
}
else
{
   redirect(base_url().'login');
}

answered Sep 7, 2012 at 12:38

Slavenko Miljic

3,8562 gold badges25 silver badges37 bronze badges

Collectives™ on Stack Overflow

CodeIgniter User Authentication

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related