Question

I have created basic login setup based upon cookie alone in codeigniter.
like this

class Display extends CI_Controller {
public function Display() {
    parent::__construct();
}
public function index() {
    //var_dump($_COOKIE);
    if (isset($_COOKIE["user"])){
        redirect('home')
    }else{
        redirect('display/login');
    }

}
public function login() {
    //var_dump($_COOKIE);
    if (isset($_COOKIE["user"])){
        $this->load->view('home');
    }else{
        $username = $this->input->post('username');
                    //some validation
        setcookie("user",$username,time()+60*60*24*30);
        redirect('home');
    }
}

}

In the home controller i check for the cookies to access the page

class Home extends CI_Controller {
public function Home() {
    parent::__construct();
    //var_dump(get_cookie("user"));exit;
     if (isset($_COOKIE["user"]) == false){
     redirect('display/login');
    }
}

}

The problem i am facing here is i cant get cookie in the constructor of the class. i need check for cookie in class before accessing any of the function in the class. what will be the proper way to do it ?. Thanks in advance.

Answer 1

You don’t assign the path parameter of the cookie, so it gets the path of the page it’s assigning it and results to be /login or something similar and it won’t be sent to other parts of your page like /home, or simply the root. Change the setcookie() like to somethig like this:

setcookie("user",$username,time()+60*60*24*30, '/'); // notice the added path at the end

Also anyone can set cookies in their client, relaying only their existence as authentication is not secure at all, anyone can change what their user cookie holds.