Codeigniter: Storing User's role in Session

views:

answers:

Codeigniter: Storing User's role in Session

Is it safe to store the user's role in Codeigniter's session?

The role will determine what function the user will have; that is being a admin, a regular subscriber, or a premium user.

I am also storing the session in a database for additional security, but I would like to know if I should use a alternate route, such as querying the user's id and checking their role but I believe that just taking it one step further in authentication.

Please advise.

Storing the role in the session along to avoid querying for it all the time should be fine if it's mostly static.

Just consider what to do in the edge case when the user's role is edited while the session is valid (logged in or not expired). Should the session be invalidated for him so he has to re-login? Or have your application know that the role is now stale and should be refreshed from the database?

Fanis 2010-09-25 09:06:30

I am using Tank Auth in Codeigniter. I am unsure how my application would invalidated the session, but it does uses the database so as Matthew said, I should be safe which I am really hoping for.

Anraiki 2010-09-25 15:30:37

@Anraiki what I meant was: say user X is logged in and you change his role. How will the session handler know to refresh that from the database to get the changed role? Perhaps you need a way to invalidate the session for that user so he can re-login, or a way to know to fetch the new role from the database

Fanis 2010-09-25 15:58:04

@Fanis I think you're over complicating it. If they want to change roles from 'user' to 'admin', there can be a function that says something like $this->session->set_userdata('role', 'admin'). You also need to save it to the respective user row so when they login at a different time it reflects correctly.

Matthew 2010-09-25 18:04:43

@Matthew if you, as admin, are logged in to the site and change a user's role, how will you access that user's session? `$this->session` will access your session. It's really an edge case, since it will happen rarely and you can just set a user property to notify the user to re-login. I just figured I'd bring it up as food for thought. Whenever you cache things aggressively you need to have a way to invalidate the caches remotely.

Fanis 2010-09-25 20:57:46

+1 A:

Yeah that's safe. If it's stored in the database, there's pretty much nothing a user can do to tamper with the data.

Matthew 2010-09-25 13:59:22

ansaurus

tags:

views:

answers:

Codeigniter: Storing User's role in Session

related questions