Member Avatar for web3

How to limit access on my page to unregistered visitors?
Like that they can't open forum or users profiles?

Edited by web3 because: n/a
  • 2 Contributors
  • 1 Reply
  • 83 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by Will Gresham

Dani AI

Generated

As asked about hiding forums and profiles from unregistered visitors and as pointed out, server-side sessions are the right starting point. For a production-safe implementation treat the session flag as only one piece of a larger access-control workflow: always check authentication and authorization on every protected endpoint, never rely on client-side code or hidden links, and centralize the check so every page or API path runs it before rendering or returning data.

Practical hardening and workflow notes:

  • Enforce per-page authorization: ensure the viewer either owns the profile being requested or has a role that permits viewing it. Return a 403 or redirect to login when unauthorized.
  • Protect session handling: regenerate the session identifier on login, set cookie flags (HttpOnly, Secure, SameSite), use reasonable idle and absolute timeouts, and destroy the session on logout. See the PHP session docs and session-regeneration guidance for details (PHP session functions, session_regenerate_id).
  • Prevent SQL injection at login and when checking permissions by using prepared statements or parameterized queries (PDO prepared statements).
  • Avoid caching protected pages by proxies or the browser; protect AJAX endpoints the same way as full pages.
  • For design scale: use role-based access control or middleware/front-controller checks so adding new protected pages does not require copy-pasting checks.

For security best practices and further rules for sessions and access control, consult the OWASP session management and access control guidance (Session Management Cheat Sheet, Access Control Cheat Sheet).

Member Avatar for Will Gresham

Use sessions, when a user signs in, create a session:

// Put this at the top of the page
session_start();

// Process the login then do this:
$_SESSION['logged_in'] = 1;

Then only allow access to the page to users who have an active session:

if(isset($_SESSION['logged_in'])) {
  // Continue with the page code
} else {
  echo "Please log in";
}
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.