PHP User Login Failure Handling

Question

On each page in an application I have a check to see whether a user is logged in. I recently realized my script was not structured well and made some changes. I am wondering if this new method implements the correct order of operations for a user that is not logged in.

<?php
ob_start();
session_start();

if ($_SESSION['loggedin'] !== true) {
    $_SESSION['messages'][] = '<li>User Not Logged In</li>';
    session_write_close();
    ob_end_clean();
    header('Location: login.php');
    exit;
}
else {
    // execute page
}
?>

Prior to this script, the ob_start() call was below the login check section and therefore was causing redirect issues given that session_start() produces its own headers.

I am also interested in knowing whether the script provides adequate security for a login check.

You should not need ob_start(); at the top unless the script is outputting something to the browser before the redirect. Are you including this script in your pages and does the including script send output to the browser before this script is called? — jeroen
– jeroen, Commented Jun 29, 2013 at 20:21
@jeroen session_start() outputs to the browser by default, so AFAIK I need the ob_start() to make sure the header() call gets executed. Other than the session this script at the very start. Explanation of Session Output and Redirects — The Thirsty Ape
– The Thirsty Ape, Commented Jun 29, 2013 at 20:47
No, you cannot start the session if the headers already have been sent. That does not mean that session_start is sending the headers. — jeroen
– jeroen, Commented Jun 30, 2013 at 1:24

Ghasrfakhri · Accepted Answer · 2013-06-29 20:27:06Z

1

This part of code is complete and secure but you have to mention few things for more security you need to regenerate the session ID with session_regenerate_id after putting valuable data like in 'loggedin' on session.

And I think it is better to put the IF part on a function and omit the else it helps your code be simpler. and Also you can remove the following lines:

session_write_close();
ob_end_clean();

answered Jun 29, 2013 at 20:27

Ghasrfakhri

13011 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

The Thirsty Ape Over a year ago

function makes sense. session_regenerate_id is included in the login script. The ob_end_clean() was added to prevent output of any data to unauthorized users. Why would I remove the other?

Ghasrfakhri Over a year ago

You have to check for authenticate before doing anything. If check first you don't have any thing to hide.

Collectives™ on Stack Overflow

PHP User Login Failure Handling

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related