Re: AUTH: multiple directories in site each with it's own login -> cross-directory authentication is happening

On 10/3/05, l Burnerheimerton <lburnerheimerton@yahoo.com> wrote: > I have a site with multiple directories. Each > directory is meant for a different "role". When you > log in to one directory you should not be able to > access another directory. > > I have a session variable identifying the user's > "role". In each directory, every page EXCEPT the > login has code which checks the session variable and > redirects or accepts the user based on sesison > qualifications. > > The problem is the login page. You obviously can not > restrict access to the login page because users would > have no way of loggin in. > > I did however, add the following to the top of the > login page: > if(isset($_SESSION['qualification'])) { > unset($_SESSION['qualification']); > header("Location: go_somewhere_else.php"); > exit(); > } > What this SHOULD do is check if the user has > qualification session variable form another directory > and redirect that user. > > What is happening, based on a session dump, when the > user whose session variable contains a quatification > from another directory comes to to this directory, > where they should not be, the user: > is stammped with the sesison variable qualifying him > as a user in THIS directory then logs him out. > > My code above is at the top of the script so it should > not even get to the point where the user is run > through AUTH again. > > What's up with this? > I'm not 100% certain that you're asking here, but sessions are generally not directory specific. In general, a session works anywhere on a website. So if you put a variable in the session in one directory it will be there in any other directories as well. -- Justin Patrin