Question

I have this simple login script:

$.ajax({
        type: 'POST',
        url: 'authorize.php',
        data: { username: user, password: pass },
        dataType: 'json',
        success: function(data) {
            if (data.status == "loggedIn") {
                //Logged in
            } else {
                //Not logged in
            }
        }
    });

Where //Logged in is, how should I call the page that required the login? I could simply $.load the page, but then what was the point of verifying a login when the user could just browse to this file in the first place?

Answer 1

I’d suggest using PHP Sessions across all of these pages. Make a check on the page you’re going to $.load that the user is actually logged in and set the user as logged in on the authorize.php page if successful.

This way, if a user looks at the page source and see’s what you’re loading, but when they try and access that page it won’t do anything because you’re checking to see if they’ve been logged in already.