Improve Security (1) - Session Control for AppGini
Posted: 2020-05-10 08:42
In this, I will show you how to implement user session control for AppGini which will give you added security for your apps
Follow the below steps
1. Create a file called session_keep.php in main folder with the following code (you can create a file with any name)
2. Include the session_keep.php file in hooks > footer-extras.php
3. Add following code to hooks > header-extras.php (This is the message prompt seen on the upper part of the window)
That's all
You can set the session out time in seconds in $session_timeout
This session out will not work on login page and guest access pages because they are not used by logged in users
Feel free to comment
- 15.png (27.39 KiB) Viewed 33466 times
Follow the below steps
1. Create a file called session_keep.php in main folder with the following code (you can create a file with any name)
Code: Select all
<?php
$script_name = basename($_SERVER['PHP_SELF']);
$user = getLoggedMemberID();
if($script_name == 'index.php' && (isset($_GET['signIn']) || isset($_GET['loginFailed'])) || $user == "guest"){ // this prevents session out in login page and guest access pages
session_unset();
session_destroy();
}
else {
session_start();
if($_SESSION['session_count'] == 0) {
$_SESSION['session_count'] = 1;
$_SESSION['session_start_time']=time();
} else {
$_SESSION['session_count'] = $_SESSION['session_count'] + 1;
}
$session_timeout = 60; // enter number of seconds here for session to live (in sec) - 60 = 1 minute - 1800/60 = 30 min
$session_duration = time() - $_SESSION['session_start_time'];
if ($session_duration > $session_timeout) {
session_unset();
session_destroy();
session_start();
session_regenerate_id(true);
header("Location: index.php?signIn=1"); // Redirect to Login Page - index.php?signIn=1 - or whatever you wish
$_SESSION['custom_err_msg']= "Your session has expired !!! Please login again"; // Enter the session out prompt you want
} else {
$_SESSION['session_start_time']=time();
}
}
?>
Code: Select all
<?php
include("$currDir/session_keep.php");
?>
Code: Select all
<?php
if (isset($_SESSION['custom_err_msg'])) {
$customError ='<div id="customErrorMessage" class="custmErrMsg alert alert-dismissable alert-danger">'.$_SESSION['custom_err_msg'].'</div>';
echo $customError;
if ($_SESSION['custom_err_shown'] == 1){
unset($_SESSION['custom_err_msg']);
$_SESSION['custom_err_shown'] = 0;
}
else {
$_SESSION['custom_err_shown'] = 1;
}
}
?>
That's all
You can set the session out time in seconds in $session_timeout
This session out will not work on login page and guest access pages because they are not used by logged in users
Feel free to comment