创建安全认证/授权模型

Question

I am looking for some advice on how to create a secure authentication/authorization model for my application. I am writing this for CakePHP but would like to be able to take this model to any application. If I could get opinions on my model and how to make it better, I would really appreciate it. This is what I have:

Each view that I want to protect has the following code it its controller:

$getUser= $this->Session->read('get_logged_user');
if($getUser == null){
            //no credentials, redirect
            $this->render('../Elements/User/login');

        }else{
            if($getUser->isAuthenticated==false){
                //not authenticated
                $this->render('../Elements/User/login');
            }else{
              //its ok, show the page.  if needs to check roles, iterate of the roles array
        }
      }

Essentially, I check to see if the correct session is available. If its not, they never logged in so redirect to the login page. If so, check authorization. My session is a class made up of the following: First/last name, user name, an array of roles, and isAuthenticated boolean. When the user logs in to my app, this object is created and put into session. The class authenticates against a database and pulls back all essential info on the user (name, roles, etc). The roles can be further used by the app to determine what the user can and cannot see and interact with. When the user clicks the "log out" button, this session object get destroyed.

Is this method secure? Should I also be using tokens or something? If more code is needed, let me know and I can post it. I know cakePhp has a security plugin but I would rather create my own from scratch.

Thanks!

Answer 1

So... you want to reinvent the wheel? Sure, go ahead. I just want to tell you a heads up.

First, let's start with something really basic. I would not copy/paste that code in every action, instead, place this in your AppController.

public function beforeFilter() { //called in all your controller actions
    parent::beforeFilter();
    $mySession = $this->Session->read('yourSession');
    if ($mySession === null) {
        $this->render('something');
        return;
    }
    if (!$mySession->isAuthenticated()) {
        $this->render('login');
        return;
    }
    //the rest of your logic
}

This approach is very basic, you might want to wrap this in a component so you can use it in another application, or you can even create a plugin, which is the best solution in this case.

If you don't want to enter into the internals of Auth then you can take a look at the Users Plugin we did in CakeDC.

Another advise (not related to the logic of Authentication) is, take care of coding conventions. They make your code easier to read and understand. Also, try to return early and avoid nesting your conditionals.

My best wishes in your learning process.