Session Management With Cwebuser::setstate Or Chttpsession

zmiftah · December 19, 2013, 5:45am

Hi all

What is the best solution on how to handle session, using CWebUser or CHttpSession? Currently i use CWebUser’s setState method, and i want to save user login info in CWebUser and then after some duration the session will expire. The problem is, when i test it, it goes well with firefox, but for some reason that i dont know, it won’t work with chrome.




class AbUserIdentity extends CUserIdentity 

{

	public $id;

	public $username;

	public $password;


        ...


	private function storeInfo($user) 

	{

		$this->setState('hasLogin', 	true);

		$this->setState('username', 	$user->uid);

		$this->setState('nickname', 	$user->unick);

		$this->setState('email', 			$user->umail);

		$this->setState('status', 		$user->ustat);

		$this->setState('lastLogin', 	date( 'Y-m-d H:i:s' ));

	}

}




class LoginForm extends CFormModel 

{

	public $username;

	public $password;

	// public $verifyCode;


        ...


	public function login() 

	{

		if ( $this->_identity->errorCode === ABUserIdentity::ERROR_NONE ) {

			$duration = 3600*3; // 3 hours

			Yii::app()->user->login( $this->_identity, $duration );


			return true;

		} else {

			return false;

		}

	}

}

What do you guys think?

sleptor · December 19, 2013, 6:25am

Your approach is right I guess.

CWebUser::setState and CHttpSession are using the same $_SESSION mechanism.

That’s why it should working the same.

http://www.yiiframework.com/doc/api/1.1/CWebUser#setState-detail

http://www.yiiframework.com/doc/api/1.1/CHttpSession#get-detail

Here is fragment of my code. It’s working perfectly with FF, Chrome and other.




class WebUser extends CWebUser {

    private $_model = null;

    public function getModel(){

       if (!$this->isGuest && $this->_model === null){

           $this->_model = User::model()->findByPk($this->id);

       }

       return $this->_model;

    }

    protected function afterLogin($fromCookie) {

       $user = $this->getModel();

       foreach ($user->getAttributes() as $attrName=>$attrValue) {

          $this->setState($attrName,$attrValue);

       }

    }

}

zmiftah · December 19, 2013, 7:39am

sleptor:

Your approach is right I guess.

CWebUser::setState and CHttpSession are using the same $_SESSION mechanism.

That’s why it should working the same.

http://www.yiiframework.com/doc/api/1.1/CWebUser#setState-detail

http://www.yiiframework.com/doc/api/1.1/CHttpSession#get-detail

Here is fragment of my code. It’s working perfectly with FF, Chrome and other.
class WebUser extends CWebUser {

    private $_model = null;

    public function getModel(){

       if (!$this->isGuest && $this->_model === null){

           $this->_model = User::model()->findByPk($this->id);

       }

       return $this->_model;

    }

    protected function afterLogin($fromCookie) {

       $user = $this->getModel();

       foreach ($user->getAttributes() as $attrName=>$attrValue) {

          $this->setState($attrName,$attrValue);

       }

    }

}

I see. But if the two class use $_SESSION mechanism, makes me wonder if the other is another solution, i am probably wrong. Anyhow thanks a lot for pointing that out.

I also read something about cookie i think. Somehow i don’t understand yet. And also the login part


Yii::app()->user->login( $this->_identity, $duration );

The $duration is set but it’s like no duration at all in my ff

zmiftah · December 19, 2013, 9:20am

Zein Miftah:

I see. But if the two class use $_SESSION mechanism, makes me wonder if the other is another solution, i am probably wrong. Anyhow thanks a lot for pointing that out.

I also read something about cookie i think. Somehow i don’t understand yet. And also the login part
Yii::app()->user->login( $this->_identity, $duration );
The $duration is set but it’s like no duration at all in my ff

Oh sorry, why do i did a stupid mistake. Actually it work on my ff but not in my chrome. And here is cookie in the chrome browser

5011

I highlight the line that i am suspicious about. Maybe that’s the cause?

sleptor · December 19, 2013, 9:25am

What is login_theme cookie? Is it non default name for php session ID cookie?

zmiftah · December 19, 2013, 9:34am

Probably cpanel. But oh sorry my mistake actually this picture is my valid attachment

5012

I see the expire based on $duration (3 hours). That aside, i am still trying to figure it out

twisted1919 · December 19, 2013, 9:37am

setState method will put your data in the cookie.

You should have nothing in the cookie but the user id which is set by Yii using CWebUser::setId() and can be retrieved using CWebUser::getId() so this means you have no reason to use setState in the first place.

setState is used only if for example you use autologin and you want some data to be available in cookie when autologin happens, but again, having the user identifier in cookie is all you need to later query the database and have access to info.

You should use Yii::app()->session to store the user data, and you should hook into afterLogin method in order to populate user data from database into session.

sleptor · December 19, 2013, 9:41am

Sure?

github.com

yiisoft/yii/blob/1.1.14/framework/web/auth/CWebUser.php#L593


	 * By storing a variable using this function, the variable may be retrieved
	 * back later using {@link getState}. The variable will be persistent
	 * across page requests during a user session.
	 *
	 * @param string $key variable name
	 * @param mixed $value variable value
	 * @param mixed $defaultValue default value. If $value===$defaultValue, the variable will be
	 * removed from the session
	 * @see getState
	 */
	public function setState($key,$value,$defaultValue=null)
	{
		$key=$this->getStateKeyPrefix().$key;
		if($value===$defaultValue)
			unset($_SESSION[$key]);
		else
			$_SESSION[$key]=$value;
	}


	/**
	 * Returns a value indicating whether there is a state of the specified name.

zmiftah · December 19, 2013, 9:44am

Very bravo explanation twisted1919, thank’s a lot

I will try this out quickly, especially afterLogin method, i dont realize the usage of afterLogin. I will post the result then.

twisted1919 · December 19, 2013, 9:45am

Ha ha, right, i think i was thinking to CUserIdentity::setState ?

Anyway, Yii::app()->session is more straight forward than setState and avoids the above confusion in general. My thoughts still stands for the approach

zmiftah · December 19, 2013, 9:49am

I am little confuse here Maybe i should refresh my understanding about cookie and session first

sleptor · December 19, 2013, 9:56am

Only session’s id stored in cookie, but data stored in files(db, redis & etc) at server.

You should read http://www.php.net/manual/en/book.session.php and http://www.yiiframework.com/doc/api/1.1/CHttpSession

zmiftah · December 19, 2013, 10:03am

How about CWebUser::setId(), do Yii set it automatically or do we should set it manually?

I dump Yii::app()->user->id after login action and it return NULL. but then i dump Yii::app()->isGuest and it return false.

Is it should return Not Null and false?

github.com

yiisoft/yii/blob/1.1.14/framework/web/auth/CWebUser.php#L286-298


				$this->clearStates();
			$this->_access=array();
			$this->afterLogout();
		}
	}


	/**
	 * Returns a value indicating whether the user is a guest (not authenticated).
	 * @return boolean whether the current application user is a guest.
	 */
	public function getIsGuest()
	{
		return $this->getState('__id')===null;
	}


	/**
	 * Returns a value that uniquely represents the user.
	 * @return mixed the unique identifier for the user. If null, it means the user is a guest.
	 */
	public function getId()
	{

zmiftah · December 19, 2013, 10:06am

Yeah i am on it. Thank’s a lot for your helps

sleptor · December 19, 2013, 10:14am

CWebUser gets ID from identity instance in login method automatically. https://github.com/yiisoft/yii/blob/1.1.14/framework/web/auth/CWebUser.php#L229.

You may override CUserIdentity::getId() in your identity implementation.

zmiftah · January 3, 2014, 7:41am

Hi guys, its been a loong time.

After took some times, i now knew how to solve this one. My problem actually was to get the login form appeared after some duration. After i read all your great responses, then i tried to tweak my codes with a couple of time and tests, i could see my desired result. After that i can share the results here as i promised.




//config.php

    ...


    'params' => array(

      // DB prefix

      'tablePrefix' => '',


      // Timeout

      'sessionTimeout' => 3600*3,

    ),

    ...

I forgot to show this class before





class AbBackController extends CController 

{

	public $layout='//layouts/column2';


	private $_assetBase;


        ...


	/**

	 * Handle Auth and Login Page

	 * 

	 * @param  CInlineAction $action

	 * @return boolean

	 */

	protected function beforeAction($action) 

	{

		$login_action = in_array($action->id, array('login','captcha'));

		$login_controller = $action->controller->id == 'site';


		if ( $login_controller && $login_action ) {

			if ( !Yii::app()->user->isGuest ) {

				if ( yii::app()->user->getState('sessionTimeout') < time() ) {

                                        Yii::app()->user->logout();

                                        $this->redirectUrl('site/login');

      	                        } else {

      		                        $this->redirectUrl( 'setting/index' );

      	                        }

			} else {

				Yii::app()->session['hasLogin']  = false;

			}

		} else {

			if ( Yii::app()->user->isGuest ) {

				$this->redirectUrl('site/login');

			} else if ( yii::app()->user->getState('sessionTimeout') < time() ) {

                                Yii::app()->user->logout();

                                $this->redirectUrl('site/login');

    	                }

		}


		return parent::beforeAction($action);

	}


        ...

}




<?php


class LoginForm extends CFormModel 

{

	public $username;

	public $password;

	public $verifyCode;


	private $_identity;


        ...


	/**

	 * Logs in the user using the given username and password in the model.

	 *

	 * @return boolean whether login is successful

	 */

	public function login() 

	{

		if ( $this->_identity->errorCode === ABUserIdentity::ERROR_NONE ) {

			$duration = Yii::app()->params['sessionTimeout']; // 3 hours

			Yii::app()->user->login( $this->_identity, $duration );


			return true;

		} else {

			return false;

		}

	}

}

And that’s it. Thanks a lot to sleptor and twisted1919, you’re all great.