Q:

login and sessions using CodeIgniter

I'm relatively new to a login system. CodeIgniter can store sessions in a database and that's what I'm doing. It stores the basics: session_id, ip, agent, and last_activity with the option of storing custom data. I've read through some tutorials and from what I understand this is how it should work:

Check if a session exists for the user (Is this necessary?)
Check the session database for a username (this would be a custom entry in the session db) if it doesn't exist, then show the login form. (and after logging in save the username to the session db)
If a username exists in the session db, check last_activity. If it's older than desired (or if the session is expired) then show the login form. If it isn't too old, then log them in.
To log out, you would just have to remove the username from the session db. (Or should I use: $this->session->sess_destroy())

Does that make sense? Should I also store the user's encrypted password in the session db and check that as well? Is there a better/different way?
Thanks.

A:

I think your approach is going into a slightly wrong direction but it is not wrong at all.
You should seperate it a bit more.
What a session actually does, is storing data that is needed over a multiple amount of requests.
The table for sessions you have in CodeIgniter has nothing to do with user information. It is only responsible for storing session related data (session_id etc.). Once you've set up the table you can use CodeIgniter Sessions as you're used to it. It will handle the session management process for you.
So let's go trough the process of a login.
First you need a table where you store user information. The most minimalistic implementation of that table would be:
users(user_id, username, password)

The only information I store in a session is the users id. So whenever a user enters your page you should check whether there is a sessionfield with your users id.
if($this->session->userdata('user_id'))
{
  //User is logged in
}
else
{
  //User is not logged in
}

If the user is not logged in you need to show your login form. After the user has sent the form you need to validate the input and check if the login attempt is successful. Your model method could look like this
public function attemptLogin($username, $password)
{
  $query = $this->db->get_where('users', array(
    'username' => $username,
    'password' => $this->mysecurityclass->superDuperHashMethod($password)
  ));
  if($query->num_rows() == 0)
    return false;
  return $query->row()->user_id;
}

What we are doing here is to check whether there is a dataset matching the user input. As you asked I provided a simple example how hashing could be done. Of course you need to implement the hashing functionality by yourself or use any ready to use classes. It's up to you. Maybe you should even encapsulate it more and already pass the hashed password to the method.
The method will return the user ID if the credentials entered matched a dataset in your users table. We know that the user is successfully logged in then. Once you got the users ID store it in your session.
$userid = $this->user_model->attemptLogin($username, $pass);
if(!$userid)
{
  //GTFO, login was not successfull
}
else
{
  $this->session->set_userdata('user_id', $userid);
  redirect('home');
}

So when the login was successful you set the session key and redirect the user. Now the process is beginning again. But now we have a session set and our initial check if we have the session field set will pass. Our user is logged in.
To log the user out you will just have to simply destroy the session as you already mentioned. Since the session key user_id will not be set anymore after that our initial check is going to return false and the user will be prompted to the login form again.
As you see. You will not have to care about how sessions are handled internally. Feel free to ask if something is unclear.
note: The code examples are only for illustration purposes. You need to think about implementation by yourself :)
Happy coding!

