PHP - 在数据库编辑期间存储在Session中的用户

Question

I have a system that represents users as object. These object are initialized by reading in a database. Once the users (or objects) are created I store them in a session in order to navigate through pages without re-initiate the users from the database.

Suppose that an admin changes (let say) the users' permissions. From the edit until the session expires, a user could have higher (or lower) permissions than those declared by the admin.

How can I handle this kind of situation? Suppose I have a sessions that expires after hours or more. Should I send a request to database every n minutes to update the user objects?

Answer 1

The way I do it in my applications is a check on every page load.

So, permissions might be stored in a session, but you can always update those.

Let's say someone logs in and their permissions are set to full.

If you're checking on every page load and updating their session, someone can update their permissions at any time and their object will have the new permissions reflected every time they perform an action.

It doesn't matter much if they're just reading a page, but when they try to do something: submit a form, go back to home, visit a new page, or whatever, then their permissions will get updated.