Thursday, 15 August 2013

How to handle different login credentials for modules in one project?

How to handle different login credentials for modules in one project?

I am fairly new to PHP programming and I think I might have some security
issues with session variables.
I am currently working on a project which has 3 modules which require
separate login credentials. The 3 modules are for students, teachers and
administration.
After the user logs in the respective portals, these credentials are
stored as session variables. Let's say we have 2 tabs open in the browser,
1 has the student portal open and the other has the admin portal open. If
the student logs in the first portal with user id 1 shortly after the
admin has loged in with user id 2, then the userid for both the portal
appears to be the same(userid 1). The problem is the session variables for
both the portals are getting shared in the browser.
Sometimes session variables are also pulled from previous session in a new
tab even after closing it.(*tested it using var_dump[$_SESSION]*)
Can somebody please explain to me how to limit the session variables to
each portals or provide me with some hints about other ways of security
handling in php?
PS: I have logout buttons which clears up the session variables. The
problem seems to persist if the tab is closed or a new portal is opened in
the new tab.
thanks in advance.

No comments:

Post a Comment