How to access the session using a session id in codeigniter - php

Question

I am creating a API in Codeigniter.
In this API I have a login function for user. If Login is successful I set user data in CI session and return the session back to user.
Now is it possible that user can use that session id to validate himself for all his other requests like add/update/delete. Basically I want that when the user sends next request I can validate his credentials based on his session id.
Client Request Code :
public function login()
{
$url = 'http://localhost/bizCloudDS/server/login';
$timestamp = gmdate("His");
$parameters = array("reqest"=>"login", "username"=> "admin", "API_AccessKey"=> "b5741564rda4a4d91965d3b5", "GMT_Timestamp"=> $timestamp);
$json = json_encode($parameters);
$encrypted = $this->bizEncrypt($json , 'enc' );
//open connection
$ch = curl_init();
//set the url, number of POST vars, POST data
curl_setopt($ch,CURLOPT_URL, $url);
curl_setopt($ch,CURLOPT_POST, 1);
curl_setopt($ch,CURLOPT_POSTFIELDS, $encrypted);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
echo $result;
curl_close($ch);
}
Now above was a sample request from client to server for Login.
On Server Side the server validates the credentials give by the client, if validated returns this json response :
{"ResponseCode":"200","Reason":"Success","Session_ID":"euo1obqeekd5vtb0ult9nj84kii1kqni"}
Now I want that if the user send another request lets say create_user in this he will send the session_id returned from the login request. So how can i fetch the session data by this session id on server side?
Is this good practice ?

Answer 1

you are on wrong way:
I recomand:
Use database and cookie for login (not sessions). OR
You need persistant curl connection (explore CURLOPT_COOKIEJAR) to understand how you login then use same session for other things.

Answer 2

If the user isn't logged directly into your system, but is using a third-party tool via API, then using the session ID doesn't make sense because there actually is no session in the traditional sense. It's a one time call/response.
It seems a better idea to use some sort of request signature to verify that the individual accessing your system is who they say they are and have the access to do what they're trying to do (ie some kind of key hash). For each call, you would authenticate the call itself, not an active session.
Or you can use a persistent cURL connection, but that could be more prone to headache.