I have to login twice

Question

For some reason the login to my site has to be done two times in order to work. If anyone has any idea why I appreciate it.

Here is the code I have for the authorization:

<?php
session_start();
require_once($_SERVER['DOCUMENT_ROOT'].'/config.php');
require_once(SITE_ROOT.'includes/exceptions.php');
require_once(SITE_ROOT.'data/model.php');

/*
 * The purpose of this class is to manage
 * access to the application, making sure the
 * users are logged in before they can access
 * certain features
 */

class Auth extends Model
{
    function isUserLoggedIn()
    {
        /*
         *  Check for the user_id in $_SESSION
         * and see if it's the database. Return
         * true or false
         *
         */

        if(isset($_SESSION['user']))
        {
            return true;
        }
        else
        {
            return false;
        }

    }

    static function redirectToLogin()
    {
        header("location: http://". DOMAIN .APP_DIR . "index.php?action=login");
    }

    static function redirectToMain()
    {
        header("location: http://". DOMAIN . APP_DIR . "index.php?action=main");
    }

    static function login($user)
    {
        /*
         * Authenticate the user passing to the function
         * a instance of the User object
         */

        try
        {
            $db = parent::getConnection();
            $pass = $user->getPassword();
            $query = "select username, password from users where username = '".$user->getUsername()."' and password = '".$user->getPassword()."'";
            $results = $db->query($query);             

            if(empty($results)) {
                throw new Exception('There was a problem logging you in', EX_LOGIN_ERROR);
            }            

            $row = $results->fetch_assoc();           

            $user = $row['username'];
            $_SESSION['user'] = $user;

        }
        catch(Exception $e){
            throw $e;
        }
    }

    static function logout()
    {
        $old_user = $_SESSION['user'];
        unset($_SESSION['user']);
        session_destroy();
    }

}
?>

Thx

Answer 1

I'd listen to @strager as your code, from my limited PHP exerience, doesn't seem to show anything that would cause the error. Although I can't help but offer some simple refactorings unrelated to your question but it would just make me feel better:

<?php
    session_start();
    require_once($_SERVER['DOCUMENT_ROOT'].'/config.php');
    require_once(SITE_ROOT.'includes/exceptions.php');
    require_once(SITE_ROOT.'data/model.php');

    /*
     * The purpose of this class is to manage
     * access to the application, making sure the
     * users are logged in before they can access
     * certain features
     */

    class Auth extends Model
    {
        function isUserLoggedIn()
        {
            /*
             *  Check for the user_id in $_SESSION
             * and see if it's the database. Return
             * true or false
             *
             */

            return isset($_SESSION['user']);
        }

        static function redirectToLogin()
        {
            header("location: http://". DOMAIN .APP_DIR . "index.php?action=login");
        }

        static function redirectToMain()
        {
            header("location: http://". DOMAIN . APP_DIR . "index.php?action=main");
        }

        static function login($user)
        {
            /*
             * Authenticate the user passing to the function
             * a instance of the User object
             */

            $db = parent::getConnection();
            $pass = $user->getPassword(); // replaced getPassword in the query with this variable, else there is no need to set it here.
            $query = "select username, password from users where username = '".$user->getUsername()."' and password = '".$pass."'";
            $results = $db->query($query);             

            if(empty($results)) {
                throw new Exception('There was a problem logging you in', EX_LOGIN_ERROR);
            }            

            $row = $results->fetch_assoc();           
            $_SESSION['user'] = $row['username'];

            // Why bother surrounding with try...catch just to throw the same exception
        }

        static function logout()
        {
            // what is $old_user used for? I can't see it set as a global variable anywhere
            $old_user = $_SESSION['user'];
            unset($_SESSION['user']);
            session_destroy();
        }

    }
    ?>

Answer 2

There just isn't enough code for us to pin-point an error. The problem is likely related to your site design where the information about your login status is sent BEFORE login is processed. If not, then I don't know what is wrong given this information.

Answer 3

It seems your question is already answered, but the problem can also occur if the web-server re-directs you automatically from for example:

yourdomain.com

to

www.yourdomain.com

or the other way around.