What is a good technique to prevent unauthenticated users from accessing controller methods?

Question

I have an event(s) controller:

class Event extends CI_Controller{

   public function index(){
   }

   public function foo(){
   }

   //Shouldn't be able to use this method unless logged in
   public function bar(){
   }


}

And I'm trying to organise my code so it's fairly tidy and straightforward. Just now I have a controller named MY_Controller so that only authenticated users can access the methods(edit_event(),add_event()) of any controllers extending it.

However, some of the methods in my controller need to be accessed by unauthenticated users (such as get_event()).

What is a good way of handling this? Should I make two completely separate controllers or extend from the basic event controller and add authenticated methods?

Previously I've had a manager controller that handled all methods which required authentication such as add_user,delete_user,add_doc,delete_doc. But it became blotted very quickly and wasn't easy to update or modify the controller (plus it was messy and didn't seem to follow good programming etiquette).

Try with an Authentication library, like http://benedmunds.com/ion_auth or an ACL: http://stackoverflow.com/questions/5556293/codeigniter-best-implementation-for-acl — Gordon, Mar 25 '13 at 18:46
Read this: http://philsturgeon.co.uk/blog/2010/02/CodeIgniter-base-Classes-Keeping-it-DRY Create another controller called member_controller or some such and extend MY_Controller, place any functions that need to be accessed only by logged in users there. I actually have 3, MY, Admin and User, admin and user extend MY which extends the base controller. — Rick Calder, Mar 25 '13 at 20:51

score 0 · Answer 1 · answered Mar 26 '13 at 17:01

usually i use hooks

read about them.

for example i created a url_hook.php and it controls everytime a page load if uri is allowed for the user:

class url_hook{

function allowed_urls(){

$allow = array('login','logout','search');

if(in_array($allow,$this->uri->segment(2)) && $this->session->userdata('user_id')){

 //ok user allowed

return true;

}else{

//user not allowed

 redirect();

} } }

then in config/config.php i do:

$config['enable_hooks'] = TRUE;

and in config/hooks.php somenthing like this:

 $hook['pre_controller'][] = array(
                                'class'    => 'url_hook',
                                'function' => 'allowed_urls',
                                'filename' => 'url_hook.php',
                                'filepath' => 'hooks'

                                );

all this will run automatically everytime a url is called in your app

What is a good technique to prevent unauthenticated users from accessing controller methods?

1 Answers1