PHP除非已登录，否则限制访问管理页面

Question

I've been thinking about methods for restricting access to admin page. One of them was using sessions and using the next code section in the admin page:

if (!isset($_SESSION['is_admin'])) {
  header('Location: index.php');
  exit; 
}

I'd like to know if there's another method for doing it , which is considered more secure. Every new point of view towards this issue will be considered helpful , thanks in advance.

Answer 1

Sessions are secure enough (if used properly), what your doing will be fine for 99% of the time. However, there are other things you can look into, like cookies , which work like sessions but are stored on the users computer and expire at a certain date. Cookies are cool because they don't expire when the browser is closed, so be careful what you store in them. Another thing to consider is SSL . If security is your concern you can secure session data with an SSL certificate. Another thing you could do is password protect an entire directory with Apache or whatever server you're using.

Answer 2

Your code seems to be matching your needs. I suggest to put your admin environment into a subfolder and protect the folder via .htaccess. A lot of webhosts let you do this (protect a folder) even by UI so it could be quite comfortable and is also secure.