Question

Here is the situation, I have setup 2 codeigniter installation.

One will be a client and one will be an api. Further improvement of this will be

1. The client will no longer be made from CI, since I wasn’t using it’s functionality. I just wanted to start out from a mvc framework right on.

My question would be where should I be storing sessions? during logins.

Below is how I did it, but I think I did it wrong.

1. I created a Login from the client. This one sends the login credentials to the api and then validated these information sent by the client and will return a message/response whethere the login credentials were valid or not.

If the login details were valid, the api will set a session in it’s controller like this

if(true) {
    $this->session->set_userdata($array);
}

This is in the login_controller I created. Is this the proper way of setting sessions for a client of a api?

Answer 1

You’ve got the concept right. You only want to set session userdata upon verifying the user supplied valid credentials.

That said, make sure you’re using encrypted cookies and, if you’re handling sensitive data, store your session data in the database. Storing it in the database causes some odd quirks with how sessions work in CodeIgniter (mainly with flashdata), but the added benefit of positive identification might potentially be worth it.

By storing the session data in the database, you can more positively verify a user is who they claim to be (in terms of the session ID, etc). The reason is because the session data is stored only in the database, and not in the session cookie (which only holds session ID and some other info). That way, even if someone does manage to decrypt the cookie, they can’t modify their userdata to pretend to be someone else, like you might be able to with the cookies only method.