使用安全吗？ 用户级别管理

Question

I use the below code on all my pages after initialising the SESSION data and defining the variable $auth_level.

I use this to decide what to show users of varying levels.

<?php
    if($auth_level == 'basic'){
        // auth_level basic
        if (!isset($_SESSION['username'])) {
            header('Location: login.php');
        }
    } else if ($auth_level == 'admin'){
        // auth level admin
        if (!isset($_SESSION['username']) || $_SESSION['role'] != 2) {
            header('Location: login.php');
        }
    } else {
        // auth level admin assumed for security
        if (!isset($_SESSION['username']) || $_SESSION['role'] != 2) {
            header('Location: login.php');
        }
    }
?>

Answer 1

This one might help:

https://stackoverflow.com/a/1225668/1437605

shortly speaking: you should store some more information in $_SESSION to distinguish clients(like ip etc.) as otherwise, I could obtain your cookie with your sessionId and that could authenticate properly depending on how you get the 'username' and 'role' values.