Codeigniter: using a custom MY_Controller effectively for user authentication - passing vars to models etc

Question

I am utilizing a custom MY_Controller to authenticate users on my Codeigniter website.

I utilize $this->load->vars($data); such that I can access the users information in views.

My first question is, does $this->load->vars($data); allow access in models, and if so how - i couldn't find any information. If not, how can I get my logged in users username to my models without having to pass it through a controller every time?

Secondly... if the user is not logged in, I redirect them redirect(base_url() . 'account/login');

This works great, except because my account controller also extends MY_Controller, it gets stuck in an infinite redirect loop. I can just not extend the custom controller for this page, but I see no reason why a logged in user should not still be able to look at the login page.. any ideas?

Finally.. if a user is logged in, $user['username'] is defined in my views. If a user is not logged in, it is not defined.

As such if i have if($user['username']!=''){ within my code, when a user IS logged in, all is fine and the code executes, however when no user is logged in errors pop up as regards an undefined variable being used in an if statement...

Codeigniter being difficult..

What is the work around here?

Many Thanks !!

Rooneyl · Accepted Answer · 2011-08-09 07:07:43Z

1

I agree with Chris about storing user details in the session.

To check if a user is logged in you could write a gatekeeper function and place it in the controllers construct to protect controllers (and therefore the views). Something like;

function gatekeeper()
{
    if (!isset($this->session->item('username')) || !$this->session->item('username'))
    {
        redirect('/account/login);
    }
}

answered Aug 9, 2011 at 7:07

Rooneyl

7,9226 gold badges58 silver badges83 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Thomas Clowes Over a year ago

This is essentially what I have, except in the construct of MY_Controller so it is automatic for all pages.. are you saying that it would be easier simply to duplicate it within each controller for which I require the user to be logged in? Thx

Rooneyl Over a year ago

If it is in your MY_Controller then it will be called for every controller that extends MY_Controller. If this is what you want then leave it where it is. If it needs to be done on a selection of controllers, then you could make the gatekeeper a helper function and just call it from individual controllers.

Rooneyl Over a year ago

Or if you want functionality to control users in terms of logged in, group, is admin, etc.. you could always use benedmunds.com/ion_auth

Chris Schmitz · Accepted Answer · 2011-08-08 22:26:40Z

1

I would consider storing the userdata for the currently logged in user in the session so that you don't need to query it and pass it to the view every time. You can access session data in the controllers, views and models with $this->session->userdata('your_userdata_var_name');.

The reason $user['username'] displays an error is probably because it's being completely removed, not set to an empty string (''), in which case you are trying to access an undefined array key.

answered Aug 8, 2011 at 22:26

Chris Schmitz

8,2876 gold badges36 silver badges41 bronze badges

2 Comments

Thomas Clowes Over a year ago

When a user logs in I authenticate them, and set a session var 'logged_in'. As a user has a lot of data associated with them, it is however easier to not have it as a session.. further to that, what are the security implications of storing all of a users information in a session - could the user for example change the data? Well.. yes - i imagine that is the case.. but if the user is not logged in - i dont want $user['username'] to be set - thats the point.. but isset() returns the same error..

Chris Schmitz Over a year ago

I guess it's a matter of preference. I would prefer to keep that in the session so that I'm not running the extra query on every page request, and if you use the database to store the session information they won't be able to update anything. I wouldn't store all information for the user in the session, but anything that I know I'll be working with on a regular basis (i.e. user ID, username, full name, etc.).

Collectives™ on Stack Overflow

Codeigniter: using a custom MY_Controller effectively for user authentication - passing vars to models etc

2 Answers 2

3 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related