Redux Authentication 1.4a (24th July 2008)

[eluser]alekz[/eluser]
Hi, again I'm been using your lib for my shopping cart project, and i was thinking that a good enhancement would be to add a remember me feature to avoid login every time the users visit the site...

Thanks in advance...

[eluser]gunter[/eluser]
[quote author="alekz" date="1211925704"]remember me......[/quote]

aren´t you logged in until the session expires??

[eluser]Popcorn[/eluser]
MCrittenden : I'm glad you are finding it easy to use.

alekz : As gunter said, you are logged in until the session expires. If you want the session to expire when the browser closes, look at this patch : http://ellislab.com/forums/viewthread/70036/

[eluser]visionit[/eluser]
Is it just me or is the "sessions" table permanently blank?

Logged in or out, the table is always empty and there are no variables defined for it in the configs either.

Any ideas?

[eluser]Tom Glover[/eluser]
Sessions table is controlled by CI sessions lib, which is configured in the main config file.

[eluser]visionit[/eluser]
Hi Research Assistant

The stange thing is... I've enabled sessions, defined the table name and enabled "use database" but it wasn't writing to the table.

I've just opened phpmyadmin and it's working?!?! :confused:

Thanks for the prompt reply.

[eluser]Tom Glover[/eluser]
Hey, Welcome to the forums, my name is actually Tom Glover or WackyWebs.net, and Research Assistant is my title. At the moment you are a Summer Student but after 30 -50 posts that will change to Grad Student.

[eluser]Sceneshift[/eluser]
I love Redux auth, I'm using it for an upcoming project but I have one concern.

At the moment, if a page is supposed to be secure, I am calling a custom function which checks if the session data is set and then query the database it check if the ID matches up with the users ID... if it all matches up, the user is authenticated.

I can't help but feel there should be more to it than that, is it possible that a hacker could somehow manipulate the session ID?

[eluser]visionit[/eluser]
As far as I'm aware, you don't need to check the session yourself... just use

if(!$this->redux_auth->logged_in()) {
// NOT LOGGED IN
} else {
// LOGGED IN
}

You could combine it with get_group to give certain users access to a page/function

if(($this->redux_auth->logged_in()) && (get_group($this->session->userdata('id')) == "admin"))
// LOGGED IN AS ADMIN
} else {
// NOT LOGGED IN AT ALL / NOT AN ADMIN
}

[eluser]visionit[/eluser]
Calling "get_group" when the user isn't logged in returns bool false... but I've adapted the library to return "guest" / 0, which makes life easier when managing group numbers in the database.