I've been using ion_auth with codeigniter for a system for 3 years now. Suddenly the sessions are not working as they should.
When user A logs into the website, their session seems to be shared with all the other users. So when user B then navigates to any of the routes, they are "logged in" with user A's credentials.
I've tested this with multiple users, as soon as a user logs into the site, all the other users that visit the site are automatically logged in with that user's credentials / session.
If the user logs out and the auth/logout route is called, the session is not destroyed and all users stay logged in on that session.
The initial redirect after login goes to /vehicle/index . Once you navigate to any other page that checks if the user is logged in, you are redirected to login.
Main Controller code:
public function vehicle()
{
if (!$this->ion_auth->logged_in())
{
redirect('auth/login');
}
else {
if (!$this->ion_auth->is_admin()) {
/**
*
* User IS NOT admin
*
**/
// Get User_id if standard user
$user = $this->ion_auth->user()->row();
// Build Crud
Controller auth.php
public function logout()
{
$this->data['title'] = "Logout";
// log the user out
$logout = $this->ion_auth->logout();
// redirect them to the login page
$this->session->set_flashdata('message', $this->ion_auth->messages());
redirect('auth/login', 'refresh');
}
Server PHP Version 5.6.30 - Build Date Feb 3 2017 07:51:58
Codeigniter version 2.2.1 - version not changed
Ion_Auth Config:
$config['hash_method'] = 'bcrypt'; // sha1 or bcrypt, bcrypt is
STRONGLY recommended
$config['default_rounds'] = 8; // This does not apply if random_rounds is set to true
$config['random_rounds'] = FALSE;
$config['min_rounds'] = 5;
$config['max_rounds'] = 9;
$config['salt_prefix'] = version_compare(PHP_VERSION, '5.3.7', '<') ? '$2a$' : '$2y$';
/*
| -------------------------------------------------------------------------
| Authentication options.
| -------------------------------------------------------------------------
| maximum_login_attempts: This maximum is not enforced by the library, but is
| used by $this->ion_auth->is_max_login_attempts_exceeded().
| The controller should check this function and act
| appropriately. If this variable set to 0, there is no maximum.
*/
$config['site_title'] = "Cars in the park"; // Site Title, example.com
$config['admin_email'] = "[email protected]"; // Admin Email, [email protected]
$config['default_group'] = 'members'; // Default group, use name
$config['admin_group'] = 'admin'; // Default administrators group, use name
$config['identity'] = 'email'; // A database column which is used to login with
$config['min_password_length'] = 8; // Minimum Required Length of Password
$config['max_password_length'] = 20; // Maximum Allowed Length of Password
$config['email_activation'] = TRUE; // Email Activation for registration
$config['manual_activation'] = TRUE; // Manual Activation for registration
$config['remember_users'] = FALSE; // Allow users to be remembered and enable auto-login
$config['user_expire'] = 30; // How long to remember the user (seconds). Set to zero for no expiration
$config['user_extend_on_login'] = FALSE; // Extend the users cookies every time they auto-login
$config['track_login_attempts'] = TRUE; // Track the number of failed login attempts for each user or ip.
$config['track_login_ip_address'] = TRUE; // Track login attempts by IP Address, if FALSE will track based on identity. (Default: TRUE)
$config['maximum_login_attempts'] = 3; // The maximum number of failed login attempts.
$config['lockout_time'] = 600; // The number of seconds to lockout an account due to exceeded attempts
$config['forgot_password_expiration'] = 0; // The number of milliseconds after which a forgot password request will expire. If set to 0, forgot password requests will not expire.
Session config:
$config['sess_cookie_name'] = 'ci_session';
$config['sess_expiration'] = 30;
$config['sess_expire_on_close'] = TRUE;
$config['sess_encrypt_cookie'] = FALSE;
$config['sess_use_database'] = FALSE;
$config['sess_table_name'] = 'ci_sessions';
$config['sess_match_ip'] = FALSE;
$config['sess_match_useragent'] = FALSE;
$config['sess_time_to_update'] = 30;
Session variable(for logged in user. All other users have the same info in the session):
stdClass Object ( [id] => 1148 [ip_address] => [username] => testing [password] => $2y$08$Q4fjUfsuOKM/Q8cnQt6j0uSXP.3mCqMnzDY1nBA9RDlwm [salt] => sadsda [email] => [email protected] [activation_code] => [forgotten_password_code] => [forgotten_password_time] => [remember_code] => [created_on] => 1426181328 [last_login] => 1490008619 [active] => 1 [first_name] => Name [last_name] => Testing [company] => [phone] => [user_id] => 1148 )
$config['sess_driver'] = 'database';
$config['sess_save_path'] = 'ci_sessions';
ci_sessions:For MySQL:
DROP TABLE IF EXISTS `ci_sessions`;
CREATE TABLE IF NOT EXISTS `ci_sessions` (
`id` varchar(128) NOT NULL,
`ip_address` varchar(45) NOT NULL,
`timestamp` int(10) unsigned DEFAULT 0 NOT NULL,
`data` blob NOT NULL,
KEY `ci_sessions_timestamp` (`timestamp`)
);
For PostgreSQL:
CREATE TABLE "ci_sessions" (
"id" varchar(128) NOT NULL,
"ip_address" varchar(45) NOT NULL,
"timestamp" bigint DEFAULT 0 NOT NULL,
"data" text DEFAULT '' NOT NULL
);
CREATE INDEX "ci_sessions_timestamp" ON "ci_sessions" ("timestamp");
The ‘database’ driver uses a relational database such as MySQL or PostgreSQL to store sessions. This is a popular choice among many users, because it allows the developer easy access to the session data within an application - it is just another table in your database.
However, there are some conditions that must be met:
$this->db from your controllers) can be used.Source: Codeigniter Session