title: What is the best practice for restricting specific pages to logged in users only in Codeigniter?
body: <p>I have created a sign-up and login for my website and all validation works fine for both sign-up and login. After user provides valid credentials he/she is logged into the member area with a welcome message that says Hello first_name last_name.. basically first name and last name is grabbed from database.</p>
  
  <p>Any way I want to do is restrict the member area to only logged in users. Anyone else will be redirected to homepage or login page or where ever I decide they should be redirected to.</p>
  
  <p>I used ci_sessions which are stored in a table "ci_sessions" in my database. Session_id, ip_address, user_agent, last_activity and user_data are the columns. So I guess that's some form of security rather than have a cookie stored on the users browser alone there is more.</p>
  
  <p>Anyway right now to stop anyone else apart from logged in users to access my website member area e.g. <a href="http://example.com/member_area" rel="nofollow noreferrer">http://example.com/member_area</a> I use a simple if statement in my controller for the member area: </p>
  
  <pre><code>if (! $this-&gt;session-&gt;userdata('first_name'))
      {
      redirect('login');
  }
  </code></pre>
  
  <p>This checks to see whether the person who is attempting to access the member area page has some kind of data stored in user_data in my ci_sessions table such as a first_name and if so allows them to access the page meaning they must have logged in and still have an active session.</p>
  
  <p>If nothing is found in the database they are redirected to the websites login page. What I want to know is if there is a better way of doing this? Is the way I'm doing it now secure enough?</p>
  
  <p>Below is my model code:</p>
  
  <pre><code>&lt;?php
  class Current_User {
  
      private static $user;
  
      private function __construct() {}
  
      public static function user() {
  
          if(!isset(self::$user)) {
  
              $CI =&amp; get_instance();
              $CI-&gt;load-&gt;library('session');
  
              if (!$user_id = $CI-&gt;session-&gt;userdata('user_id')) {
                  return FALSE;
              }
  
              if (!$u = Doctrine::getTable('User')-&gt;find($user_id)) {
                  return FALSE;
              }
  
              self::$user = $u;
          }
  
          return self::$user;
      }
  
  
      public static function login($email, $password) {
  
          // get User object by email
          if ($u = Doctrine::getTable('User')-&gt;findOneByEmail($email)) {
  
  
              // to ge the mutated version of the input password
              $u_input = new User();
              $u_input-&gt;password = $password;
  
              // password match
              if ($u-&gt;password == $u_input-&gt;password) {
  
  
                  $CI =&amp; get_instance();
                  $CI-&gt;load-&gt;library('session');
                  $CI-&gt;session-&gt;set_userdata('user_id',$u-&gt;id);
                  $CI-&gt;session-&gt;set_userdata('username',$u-&gt;username);
                  $CI-&gt;session-&gt;set_userdata('first_name',$u-&gt;first_name);
                  $CI-&gt;session-&gt;set_userdata('last_name',$u-&gt;last_name);
  
                  self::$user = $u;
  
                  return TRUE;
              }
  
              unset($u_input);
          }
  
          // login failed
          return FALSE;
  
      }
  
  
      public function __clone() {
          trigger_error('No duplicates allowed.', E_USER_ERROR);
      }
  
  }
  </code></pre>
  
  <p>All your advice is appreciated.</p>
  
  <p>UPDATE</p>
  
  <p>How about adding this to my model</p>
  
  <pre><code>$CI-&gt;session-&gt;set_userdata('logged_in', 'TRUE');
  </code></pre>
  
  <p>This basically adds "logged_in" to my user data in session in DB with the value "TRUE".
  in my controller for my "member area" I have edited the if statement to say this:</p>
  
  <pre><code>if (! $this-&gt;session-&gt;userdata('logged_in')==TRUE)
  {
  redirect('login');
  </code></pre>
  
  <p>}</p>
  
  <p>If the item doesn't exist "which it won't if a user isn't logged in" then FALSE will be returned and user will be redirected to login page</p>
  
  <p>What do you think?</p>
  
  <p>or I could even make TRUE something secret like dsb453rerfksdhbdsks322 for example. Something random.</p>