PHP Session Variables Dropped Between Controllers - php

Question

So the problem is, when /MVCTest/manage/dashboard is called, the authenticator is failing because authenticate (a method in the authenticator class) is not finding $_SESSION['user_id'], so it kicks the user back to the login page.
However, if I change the action below to:
action="/MVCTest/manage/login?target=MVCTest/manage/dashboard"
and add the same login function form the index controller to the manageController, everything works fine, but this means I would have to have a login function in every controller that has a page I want to login from (which is every page since I want a user dashboard).
So how do I get the $_SESSION to presist between controllers so I can have a single controller responsible for logging a user in/out?
First, some code...
action="/MVCTest/index/login?target=MVCTest/manage/dashboard" calls the login action of the indexController.
<?php
Class indexController Extends Core_Controller {
public function login(){
$this->registry->authenticator->login($_POST);
}
}
?>
The authenticator object was created in the bootstrap and assigned to the registry. Now for the authenticator object.
<?php
Class Authenticator Extends Base_Model {
public function login($credentials){
//Select user from the database based on email/username
try{
$STH = $this->db->prepare("SELECT * FROM user_account WHERE email = ? OR username = ?");
$STH->bindParam(1, $credentials['login']);
$STH->bindParam(2, $credentials['login']);
$STH->execute();
while($user = $STH->fetch(PDO::FETCH_OBJ)){
$password = $user->user_salt.$credentials['password'];
$password = $this->hashData($password);
try{
if($password === $user->password){
//Active and Verified user exists, set sessions
$random = $this->generateRandomString();
//Build the token
$token = $_SERVER["HTTP_USER_AGENT"] . $random;
$token = $this->hashData($token);
//Setup session variables
session_start();
$_SESSION["token"] = $token;
$_SESSION["user_id"] = $user->id;
//Delete old session records for the user
$STH = $this->db->prepare("DELETE FROM user_session WHERE user_account_id = ?");
$STH->bindParam(1, $user->id);
$STH->execute();
//Insert new session records for the user
try{
$STH = $this->db->prepare("INSERT INTO user_session (user_account_id, session_id, token)
VALUES (?,'".session_id()."', ?);");
$STH->bindParam(1, $user->id);
$STH->bindParam(2, $token);
$STH->execute();
header("Location: /{$_GET['target']}");
exit;
} catch (PDOException $e){
file_put_contents(__SITE_PATH."/logs/errors/MySQLErrors", $e->getMessage()."\n", FILE_APPEND);
die($e->getMessage());
}
} else {
throw new Exception("Password is incorrect!");
}
} catch (Exception $e){
file_put_contents(__SITE_PATH."/logs/errors/LoginErrors", $e->getMessage()."\n", FILE_APPEND);
die($e->getMessage());
}
}
//Email/Username not found
throw new Exception("Email/Username not found!");
} catch (Exception $e) {
file_put_contents(__SITE_PATH."/logs/errors/LoginErrors", $e->getMessage()."\n", FILE_APPEND);
die($e->getMessage());
} catch (PDOException $e){
file_put_contents(__SITE_PATH."/logs/errors/MySQLErrors", $e->getMessage()."\n", FILE_APPEND);
die($e->getMessage());
}
}
}
?>
And finally, my manageController
<?php
session_name();
session_set_cookie_params(3600, "/MVCTest/manage/");
session_start();
Class manageController Extends Core_Controller {
public function index() {
if(isset($_SESSION['user_id'])){
header("Location: /MVCTest/manage/dashboard");
exit;
}
$this->registry->template->show('manage/index');
}
public function dashboard(){
$this->registry->authenticator->authenticate("/MVCTest/manage/");
$this->registry->template->show('manage/dashboard');
}
}
?>
I found the answer. Leave session_name();
session_set_cookie_params(3600, __SITE_PATH.'/MVCTest/manage/'); in the manageController while moving session_start(); to the beginning of the extended Core_Controller while adding a public login function.
The result is that every page can log somebody in; however, I feel like this is bad practice. The problem I see is that every single page call will start a session regardless of if the user is logged in or not. I get the feeling that this is bad, any suggestions?

Answer 1

Look at this code:
//Setup session variables
session_start();
$_SESSION["token"] = $token;
$_SESSION["user_id"] = $user->id;
You must use
session_start();
At the beginning of the file.
Read more about session_start