CODEWITHSUNDEEP
php
q0987
q0987

Reputation: 35984

PHP - Good practice to apply multi-level PHP User Authorization

Given a website site has different web pages that can only be accessed by different group of users. Say guest users can only access welcome page/search page, while, administrator users can access pages that update the DB, etc.

I have little experience on this field and would like to adopt some best practice with clean/simple/secure implementation.

If possible, I would like to see some concrete examples/tutorials, even a book resource.

Thank you for your helps

Upvotes: 3

Views: 2282

Answers (2)

dwich
dwich

Reputation: 1725

Each user can have a role or roles in your application / website. Imagine you have an application where some people can edit users and others can insert tasks while others can solve the tasks. Create three roles: user managers, task assigners and task solvers.

Then give users their roles.

Some people call roles groups. You group people to give them permissions. I prefer calling it role because user acts as HR manager or website publisher etc.

This is just a simple example, it's always based on requirements you have. There can be team-based permissions, department-based permissions etc.

http://en.wikipedia.org/wiki/Role-based_access_control

Personally, I have an application broken down to modules. Each module has objects and these objects have actions. Example: user.department.list = in module user, there's an object department and action list (departments). When you create role or group, assign these permissions to that role (group) and users. For role User managers, there're permissions user.user.list, user.user.edit, user.department.list, user.department.edit. After you authenticate a user (to know who's he) load roles he's assigned to. Each page (controller) or each method can check user's permissions - is this user permitted to list departments?

Upvotes: 3

Alex
Alex

Reputation: 14618

I have found that many applications available online (Wordpress, Joomla, and many other), are very poorly organized in this field (poorer than what I do, in any case).

Take a look at how it's done for MVC frameworks like Zend Framework, CakePHP, Symfony. MVC is mostly used for bigger projects that tend to be much more organized, so I am betting that they have worked a lot on authentication too.

In 2 words, for this to work properly, all your page generation classes (I advise the use of OOP) must be derived from a parent class, which will hold access control methods. Or you could have a class with static functions for access control. Before any action, simply call these functions to check whether the user has access to this functionality. Functionality can be grouped into Classes, with many Methods (in MVC - Controllers and Actions). You can store access information in the database as follows: groupID, Class, Method, Permission, where permission could be a boolean Grant or Deny. To promote speed, extract all user's permissions at first query, store it in an array or object, so as not to generate a query for each permission verification in the user request, but parse the saved data instead..

Upvotes: 4

Related Questions