Question

i have login form, and then i try to access the controller directly, it works ! how do i prevent this access ?

i got some class

class C_home extends CI_Controller{

public function __construct() {
    parent::__construct();
    $this->session->set_userdata('islogin'); //to set session islogin
}

function index()
{
    if ($this->session->userdata('islogin') != TRUE) 
    {
        redirect('c_home','refresh'); //caused infinite refresh
    }
        redirect('c_login', 'refresh');
}
}

then i try to direct access controller, the page show infinite refresh, i want the page to show the login form

how do i resolve this ?

Answer 1

I’d rather do this like so

class C_home extends CI_Controller {

public function __construct()
{
    parent::__construct();
}

function index()
{
    if ($this->session->userdata('islogin') != TRUE) 
    {
        redirect('c_home/login','refresh'); // go for login
    }

    // do something for loged in users here

}

function login()
{
    if ($this->session->userdata('islogin') == TRUE) 
    {
        redirect('c_home','refresh'); // get back home
    }

    // perform some login logic here
    // then, if successful
    {
        $this->session->set_userdata('islogin',TRUE);
        redirect('c_home','refresh'); // get back home
    }

    // or else
    // display login form here 

}

Of course is always better to use third party login library like this one https://github.com/DaBourz/SimpleLoginSecure