Encrypting URI Segments

[eluser]dblackherod[/eluser]
People... I am glad that this agenda has attracted this much attention and that @wanwizard is in on the conversation as well.

My point is not that controllers should be written for different user groups, neither is it that the system's design is flawed from day one... NO!

it seems only @mauricio understands what i'm getting at.

All i'm saying is... how can URI segments be safe from unnecessary traversal to access unauthorized resources by unauthorized users without refactoring a sea of code.?

The quickest way that comes to thought is URI segments encryption. Another good idea just mentioned is defining what URI segments are allowed for different user groups.

I hope this explanation gives us a clear understanding of the agenda.

The system design is not flawed because URI segments can be traversed manually, neither is it necessary to write controllers for each user group's functionality; its just so that the CI framework does not handle such for us and as good developers capable of building complex systems, we should be able to figure effective implementation approaches to problems such as this.

I still insist that encrypting URI segments is the safest approach to achieving this cause and all that are needed include;

1. A Simple Encryption class Library with encryption and decryption methods
2. A MY_Router class extension overriding the _set_request method
3. A MY_URI class extension overriding the site_url method.

A brilliant alternative would be to define which URI segment combinations are allowed for various user groups. But, on second thought, how would module developers know what groups have been created for an instance of the application such that they are able to define URI segments authorizations accordingly?

This still leaves the encryption option an undisputed approach.

Baseline remains that all I need to know is which Router and URI functions to override because I was able to encrypt and decrypt the URI segments but i became unsure which Router and URI methods to override when i realized the need for uri_to_assoc helper method uses URI segments.

I'm also willing to pay someone to make this feature a reality 'cos I was so close to achieving it...