使用会话限制对页面的访问时，如何处理用户清除会话？

Question

I have a page that I restrict access to by checking if a certain session variable is set. But then again, users can clear that session variable and now have access to the page.

What can I do to prevent this? I am using php

Answer 1

...您可以设置谁可以访问该页面的人会话变量，而不是相反？

Answer 2

Deny all, allow some.

Assume people without a session are not allowed.

Answer 3

通常，用户通常无法自行清除变量（除非您的代码为他们清除了变量），而只能自行删除会话cookie，这会破坏整个会话（现在您可以限制访问权限）。

Answer 4

In a PHP header at the TOP of the various pages you want to restrict access to, you'd put something like the following:

<?php
   session_start(); // start the session
   if (!isset($_SESSION['allowaccess']) || ($_SESSION['allowaccess'] == FALSE)) {
      // if the access token is not present or the token is false, then...
      echo "Access denied."
      exit();
   }
?>

<h1>Super Seekrit Data</h1>

<p>yada yada yada</p>

This way, if the users clear their cookies or log out or whatever, the pages with this type of code will now deny access. Of course, they might still have a cached copy present on their end and can see the content until such time as the cache expires, but that's another problem to solve.