Controlling Page Access by User Role

The Core Principle: Checking the Session

The foundation of access control in a session-based system is simple: on any page that needs protection, we must first check the $_SESSION superglobal for proof of authentication. This "proof" is the session variable we created during login (e.g., $_SESSION['user_id']).

• If the session variable exists, the user is authenticated, and we can show them the page.
• If it doesn't exist, the user is a "guest," and we must deny access, typically by redirecting them to the login page.

This works both ways. We can also prevent authenticated users from accessing guest-only pages, like the registration or login forms.

1. The Direct Approach: Page-by-Page Protection

The most straightforward way to protect a page is to add a small block of PHP code at the very top of the script.

As the resource demonstrates, the logic is placed at the beginning of any file you want to protect. If a user is not logged in, we redirect them and, crucially, stop the script from executing any further.

Here is the essential code pattern for a members-only page (e.g., dashboard.php):

<?php
session_start();

// Check if the user is not logged in
if (!isset($_SESSION['user_id'])) {
    // Redirect to the login page
    header('Location: login.php');
    // Stop script execution
    exit;
}

// If the script reaches this point, the user is authenticated.
// You can now display the protected content.
echo "Welcome to your dashboard, user #" . $_SESSION['user_id'];
?>

It's vital to call exit; immediately after the header() redirect. Without it, the PHP script would continue to run and could potentially expose protected information to the unauthenticated user before the browser processes the redirect.

This same logic can be inverted for a guest-only page like register.php:

<?php
session_start();

// Check if the user is already logged in
if (isset($_SESSION['user_id'])) {
    // Redirect them to the dashboard
    header('Location: dashboard.php');
    exit;
}

// If the script reaches here, the user is a guest.
// Show the registration form.
?>

This prevents a logged-in user from nonsensically trying to access the registration page again.

2. The Problem with the Direct Approach: Duplication

The direct approach is simple and effective for one or two pages. But what happens when your application grows? If you have 10, 20, or 50 pages that require authentication, you would have to copy and paste that same block of code into every single file.

This violates a core software engineering principle: Don't Repeat Yourself (DRY). If you ever need to change the logic (e.g., redirect to a different page or add a log entry), you'd have to find and update every single copy. This is inefficient and prone to errors.

Your goal is to build professional applications, so we need a more scalable and maintainable solution.

3. A Modern Solution: Centralizing Logic with Middleware

A more advanced and organized approach is to handle access control in a central location before the request even reaches the target page script. This concept is often called middleware. Middleware acts as a gatekeeper that inspects incoming requests and can decide whether to let them pass, modify them, or reject them.

The following video from Laracasts, a highly respected source for professional PHP training, walks through the process of building a simple middleware system from scratch. This is a powerful concept used in all modern PHP frameworks.

Let's recap the powerful architecture you just saw:

• Centralized Rules: Instead of adding PHP code to every view/controller file, you declare the access rule once in your routes file (e.g., $router->get('/notes', 'controllers/notes/index.php')->only('auth');).
• Separation of Concerns: The router is responsible for mapping a URL to a controller, and the middleware is responsible only for authorization. The controller itself doesn't need to worry about whether the user is logged in; it can assume the middleware has already done its job.
• Reusability and Maintainability: You have a single AuthMiddleware class and a single GuestMiddleware class. If you need to change your authentication logic, you only change it in one place.

This middleware pattern is fundamental to building robust, modern web applications and is a significant step toward your goal of PHP mastery.

4. Security Spotlight: Why This Matters

Properly restricting access is the primary defense for user data. A valid session is effectively a key that unlocks the protected parts of your application. This makes the session itself a valuable target for attackers. Given your interest in cybersecurity, it's important to understand the threat.

One of the most common attacks against session-based systems is Session Hijacking.

When an attacker steals a user's active session ID (e.g., by intercepting network traffic or tricking the user into clicking a malicious link), they can present that ID to your server and gain full access to the user's account.

This is why the techniques from our previous lessons are so important:

• Using HttpOnly cookies (as seen in the logout.php script) prevents client-side scripts from accessing the session cookie.
• Using HTTPS encrypts all traffic, preventing attackers from "sniffing" the session ID from the network.
• Regenerating the session ID upon login (session_regenerate_id(true)) ensures that even if an attacker had an old session ID for that user, it becomes invalid the moment the legitimate user logs in.

Your access control logic is only as strong as the session it relies on.

Conclusion

You have now mastered the complete user authentication workflow. You can register users, log them in, log them out, and most importantly, enforce access rules to protect your application's pages.

Key Takeaways:

• The fundamental way to protect a page is to check for a session variable (e.g., $_SESSION['user_id']) at the top of the script and redirect if the user is not authorized.
• This direct method leads to code duplication and is not scalable for larger applications.
• A professional, modern solution is to use middleware to centralize access control logic at the routing layer, keeping your controllers clean and your code DRY.
• A valid session is a powerful key; understanding threats like session hijacking highlights the importance of securing the session itself.

Preview of the Next Lesson:
With the user authentication module complete, we are ready to explore a new and essential area of web development: APIs. In the next lesson, we will begin Module 9 by learning the principles of REST and the use of HTTP methods (GET, POST, PUT, DELETE). This will lay the foundation for you to build applications that can communicate with other services and provide data to front-end frameworks.