Question

I’m developing a website using HMVC patterns and CodeIgniter.

I have some modules which should never be accessable if a user is not logged in.

When a user logs in, it sets a session is_logged_in

Now, I tried this code and it seems to work as it should, however I am not sure if it’s secure.

I put this in the controllers constructor:

if ($this->session->userdata('is_logged_in') == NULL) { exit; }

Is this secure, or can it be bypassed?

Answer 1

// make helper helper, ex. my_login_helper

if (!function_exists('is_logged_in')){

    function is_logged_in(){
        // Get current CI instance
        $CI =& get_instance();
        // use $CI->session instead of $this->session
        $user = $CI->session->userdata('is_logged_in');
        if (!isset($user)) { return false; } else { return true; }
    } 

  }

// repeating the same code on every controller just to check if the user is logged in
// make My_Controller

  function _remap($method)
    {
        if (method_exists($this, $method) && $this->my_login_helper->is_logged_in())
        { $this->$method(); }
        else {  redirect('/auth/'); }
    }