Menu
Community /Pin to ProfileBookmark
@NogDogApr 10.2013 — #One possible alternative is to have an optional parameter for "important" pages that looks at the last login time (which you'd track in the session data), and if it's more than some arbitrary number of minutes (hours, seconds?) old, then it requires the user to login again (and typically also generates a new session ID). This way you can require a "fresh" login for operations that modify data or that reveal sensitive data, while being more lenient about general view-only actions.
Access Control System Lookup
Hello,
I’m working on a project with an authentication system that i’m looking to clean up. The short story of this project is a lack of consistency regarding authentication. I have a table of users and a table of profiles with associated permissions. I’m looking at going two routes:
Option 1: Query the database on every page to check to see if the user has permission, then allow or deny them
Option 2: Query the database when they login and store all the permissions in the $_SESSION array. Currently the system uses this method.
I’ve done some reading, and i’ve heard arguments on both sides. Can anyone offer some additional insight? The one thing I am considering right now is that in the process of revising authentication, there will be a lot more individual permissions added, which would make the array considerably large. Would there be any noticeable performance issues with going either route?
Sign in
to post a comment1 Comments(s) ↴
0
@NogDogApr 10.2013 — #