Thread: Security issue
View Single Post
  #2 (permalink)  
Old 08-14-2007, 09:01 PM
Elemental's Avatar
Elemental Elemental is offline
Senior Member
 
Join Date: Jul 2007
Posts: 122
Default

yes and no.

Zend_Auth::getInstance() actually creates a session name space. I believe the default is 'Default'. Once a user authenticates that namespace recieves an identity. So to check if a user is authenticated you do the following:

Code:
//get an instance of the auth object which is bound to the session namespace 'Default'
$auth = Zend_Auth::getInstance()  
if ($auth->hasIdentity()) {
   echo "Authenticated!";
} else {
   echo "Not Authenticated!";
}
Here's a good tutorial for getting started with Zend_Auth

What I prefer is to actually create my own session namespace in my bootstrap:
Code:
$session = new Zend_Session_Namespace('Default');
Zend_Registry::set('session', $session);
This allows me to use session based features without an authenticated user. Then I setup the auth object to use that session.
Code:
$auth = Zend_Auth::getInstance()  
$auth->setStorage(new Zend_Auth_Storage_Session('Default'));
It seems redundant as I used 'Default' for my namespace, you can call it what ever you want. The reason I prefer this method is to avoid creating multiple sessions. This way I create a session and when the authentication takes place it uses the same existing session vs. creating a new authenticated session. That and I get to play with more Zend gewdness.

Last edited by Elemental : 08-14-2007 at 09:09 PM.
Reply With Quote