I write this session helper class to use it inside my projects for managing the $_SESSION
variables setup after an user login or logout. It's very simple and after some tests it seems to work smoothly and fine.
The class doesn't have a constructor, this because the needed parameters that are the username and the user id are passed directly to the setSession
method.
The sessionCode
method is instead only a code who is used to check if the user is logged in or not, this to limit the access to certain pages if needed.
<?php
namespace library;
class SessionHelper{
private $username;
private $id;
private $ip;
public function setSession(string $email,int $id){
session_regenerate_id();
$_SESSION['session_code'] = $this->sessionCode();
$_SESSION['user_ip'] = $_SERVER['REMOTE_ADDR'];
$_SESSION['user_id'] = $id;
$_SESSION['username'] = $email;
return true;
}
public function sessionStatus(){
if(isset($_SESSION['session_code'])){
if(hash_equals($_SESSION['session_code'], $this->sessionCode())){
return true;
} else {
return false;
}
}
}
public function unsetSession(){
session_unset();
session_destroy();
return true;
}
private function sessionCode(){
return hash('sha256', session_id());
}
}
?>
USAGE EXAMPLE AFTER A LOGIN SCRIPT:
<?php
require_once 'SessionHelper.php';
use library\SessionHelper as SessionHelper;
$session = new SessionHelper;
$session->setSession('user1', '4');
?>
USAGE ON RESTRICTED ACCESS PAGES
<?php
session_start();
require_once 'library/Autoloader.php';
use library\SessionHelper as SessionHelper;
$session = new SessionHelper;
if($session->sessionStatus() != true){
header('Location: index');
die();
}
?>
session_regenerate_id()
here? I also can't see how you're using the session code in a safe manner. You must be accessing$_SESSION
outside this helper class, which defeats the point of having this class. The idea behind classes is that they abstract things for you. So it shouldn't matter whether you use$_SESSION
to implement this class, or something else, you can always use it in the same way. \$\endgroup\$ – KIKO Software Jul 3 '18 at 12:28session_regenerate_id()
does, and when you use it, but why do you need to regenerate the session id after a successful login? I don't see the point of that. No, I don't have a suggestion about the session code, but I would like to see how it's being used by you. \$\endgroup\$ – KIKO Software Jul 3 '18 at 14:21if(!isset($_SESSION['session_code']))
..so it will be only a check. I'm thinking to implement this control inside a class method \$\endgroup\$ – user9741470 Jul 3 '18 at 18:11user_logged_in
. \$\endgroup\$ – KIKO Software Jul 3 '18 at 19:57