How to make some pages not available when a user is logged in

Question

In CakePHP we can use $this->Auth->allow('someMethod'); to make a page viewable without having to login. How do I make some the same page is not viewable when a user is logged in? An example of this would be a register page which we want to be accessible without user logged in ... but not accessible once a user logged in.

I put $this->Auth->deny('someMethod') in isAuthorized() but it seems to me that if the method is in the allow list then isAuthorized is not called when we try to run that page.

Any input? Thank you

Answer 1

EDIT:

Wasn't aware that CakePHP used a different syntax.

You can then use the following to set the Session variable:

$this->Session->write('user_id', '<some_user_name>');

Then use this to redirect the user if they are logged in:

if ($this->Session->check('user_id'))
{
    $this->redirect('http://google.com');
}

And then to destroy a Session use:

$this->Session->destroy()

More information about CakePHP Sessions

Thanks

Answer 2

There are no complex rules like that built into Cake Auth. You'll have to manually check for conditions like this. It's very simple though:

// Controller
function register() {
    if ($this->Auth->user()) {
        $this->redirect(/* somewhere else */);
    }
}

Contrary to mlevits answer, you don't need to store anything in the Session, the info is readily available from the AuthComponent itself. http://book.cakephp.org/view/387/user

There's also an example how to do it by dynamically using deny(), but that's not as clear in a simple case like this IMHO. http://book.cakephp.org/view/383/deny
Also, deny() produces an error message ("You're not authorized to access this location"), which is probably not what you want for the user experience in this case.

Answer 3

You can check it in method beforeFilter in AppController to allow aplication-wide check. For example:

<?php
class AppContoller extends Controller {
    var $components = array('Session', 'Auth');

    function beforeFilter(){
        $this->Auth->allow('register', 'home');
        // Check if current action allowed to access without authorization and User has login
        if(array_key_exists($this->params['action'], $this->Auth->allowedActions) && $this->Auth->user()){
            $this->redirect(/* somewhere else */);
        }
    }
}
?>

Of course you can also implements it in some controller instead of AppController.