Question

Given a website site has different web pages that can only be accessed by different group of users. Say guest users can only access welcome page/search page, while, administrator users can access pages that update the DB, etc.

I have little experience on this field and would like to adopt some best practice with clean/simple/secure implementation.

If possible, I would like to see some concrete examples/tutorials, even a book resource.

Thank you for your helps

Answer 1

I have found that many applications available online (WordPress, Joomla, and many other), are very poorly organized in this field (poorer than what I do, in any case).

Take a look at how it’s done for MVC frameworks like Zend Framework, CakePHP, Symfony. MVC is mostly used for bigger projects that tend to be much more organized, so I am betting that they have worked a lot on authentication too.

In 2 words, for this to work properly, all your page generation classes (I advise the use of OOP) must be derived from a parent class, which will hold access control methods. Or you could have a class with static functions for access control. Before any action, simply call these functions to check whether the user has access to this functionality. Functionality can be grouped into Classes, with many Methods (in MVC – Controllers and Actions). You can store access information in the database as follows: groupID, Class, Method, Permission, where permission could be a boolean Grant or Deny. To promote speed, extract all user’s permissions at first query, store it in an array or object, so as not to generate a query for each permission verification in the user request, but parse the saved data instead..