Just a quick database design question

[eluser]megabyte[/eluser]
If you were building a website with an admin area for the business owner that is completely different from the admin area for the memebers area, would you create 2 different tables to hold the information? this way you could set a session for the admin with user_id, and for the members area a member_id.

I find its a pain in the but when developing this sort of thing, because you'll possibly want to have both admin areas open at the same time and if they both use the same unique id to store a session you cant do this.

[eluser]alboyd[/eluser]
I'm not entirely sure I understand what you mean by two admin areas but in regards to the session why not store all session data related to each admin area in separate arrays within the session?

[eluser]jedd[/eluser]
I wouldn't think so much in terms of areas, as entities and attributes. But I'm a bit old school like that.

Have you done any data modelling of what information you actually want to record in your auth schema?

[eluser]megabyte[/eluser]
Maybe I don't understand sessions enough.

Here's a better question which may be able to help me. I use Firefox. Now I thought that every browser window is supposed to hold a unique session, is this true? Meaning if I create a session in a browser window, then open another browser window manually, there should be no session set yet in the new window right?

[eluser]brianw1975[/eluser]
No, as of ff3.0.13 it does not store separate session data for each tab (or window), it would require setting multiple cookies for any one site and then opening a new tab would require you to log into a site you are already logged into, etc... would get very annoying, very quickly, and be an utter nightmare when recovering from crashes.

As far as administrative areas goes (the actual OP), i tend to make one administrative area and then assign different permission levels for the admin users with highest level going to the site owner (you could even make it so that the site owner is a separate session var. Either way, start at the top (100) with admin user level with most access, then next level down at 90, then reduce by 10 per level, this will give you the ability to add levels in there later on easily if needed.

then based on their access level you can (not)display content based on that level -- one of the Auth libraries would be a good place to start

[eluser]jedd[/eluser]
I don't think it's an ff3 thing - I've never seen any browser do this. It's one of the handy things about having multiple browsers available (in my case, konqueror and iceweasel).

If you're limiting yourself to working in a Microsoft platform, then you'd probably go Firefox and Chrome, or maybe Opera.

[eluser]brianw1975[/eluser]
[quote author="jedd" date="1251265949"]I don't think it's an ff3 thing - I've never seen any browser do this. It's one of the handy things about having multiple browsers available (in my case, konqueror and iceweasel).

If you're limiting yourself to working in a Microsoft platform, then you'd probably go Firefox and Chrome, or maybe Opera.[/quote]

heck, I have FF3, IE8, Chrome, Opera and Safari all installed. And that's just on the local machine, my linux server runs VMWare server with a win2k installation and the browsers installed in the linux server itself.

[eluser]alboyd[/eluser]
Maybe slightly off topic (well rest of thread pretty much is anyway) but how would we check if someone has two of the same browser open and are trying to access the same session? We would want to stop this in a lot of cases I suspect.

For example sometimes I store "last_selected_blah_id" into the session - I wouldn't want another instance of my site running in another window to change this value as it would impact on the experience within the initial window.. if you see what I am saying?

[eluser]brianw1975[/eluser]
whew.... that'd probably be a bit complicated... if the entire experience was AJAX based (or frames) that would make it pretty simple by passing a "nonce" value in the data streams... and use it something like a security token.

other than that I'm not sure. I've only dealt with using a nonce to ensure that sessions weren't able to be duplicated in any 24 hour period...

keep us posted on how you accomplish this security measure.

[eluser]alboyd[/eluser]
What is a "nonce" - google not helping!

My site is entirely ajax based (pretty much anyway)