::: illustration ![nicolasbrondinbernard_A_lock._100_white_background.jpg](https://code-garage-strapi-bucket-production.cellar-c2.services.clever-cloud.com/nicolasbrondinbernard_A_lock_100_white_background_961ef456b2.jpg) ::: When it comes to creating a basic authentication system in PHP, you need to master several concepts: * Logging the user in * Knowing who is authenticated and who is not * Reconnecting the user on each visit * Logging the user out **It is common to use a database to store user information**, but to simplify this module, the login information will be stored directly on the server. > **This is not a recommended solution**, but it will allow you to understand the concepts more quickly! Here is the final file structure you should have at the end of this module: ```plaintext my-website/ ├─ controllers/ │ ├─ login.php │ └─ logout.php ├─ login.php └─ dashboard.php ``` Note that the `controllers` folder is used to store all PHP scripts **that process data but do not return any HTML page.** > This helps keep your code organized more cleanly in the long run ## Logging a user in ### Login form The first step in handling authentication on a site **is to allow the user to enter their login information!** > On a typical site, you would also let the user sign up, but this part is very simple once you master the rest of the process! So we'll first create a very simple form to **enter a username and a password:** !!! well `login.php` ```html

Connexion

``` !!! Every time the form is submitted, the `controllers/login.php` script will be called and will be responsible for checking the submitted information! > Let's now see what's inside this script! ### Verifying the login In our simplified example, **we just need to check that `username` and `password` match** the values stored on the server, then: * If the data matches, **we launch authentication** * Otherwise we redirect to the `login.php` form **with an error** !!! well `controllers/login.php` ```php ``` !!! > But what exactly happens in this `authenticate()` function? That's what we're going to discover in the rest of the module, but first we need to understand the concept of "sessions"! ### Creating a session **A session is a set of variables linked to the visitor's browser** that can be read or modified at will. It's a very powerful mechanism, because when information is present in a user's session, **then all your PHP pages have access to it!** > Session data is stored in the ```$_SESSION``` superglobal To create and access session data, each script must use the `session_start()` function, like this: !!! well controllers/login.php (suite) ```php session_start(); // ... function authenticate($username) { // Enregistrer l'utilisateur dans une session $_SESSION['username'] = $username; // Redirection vers le tableau de bord header('Location: dashboard.php'); } ``` !!! The role of our `authenticate()` function is therefore to store the name of the currently logged-in user, so that the other pages of our site can retrieve this information. > Then we simply redirect the user to the `dashboard.php` home page, available only to logged-in users ### Checking that the user is logged in The `dashboard.php` page is accessible only to authenticated users. To do this, we will check whether the user is logged in using the data present in the session. !!! well `dashboard.php (début)` ```php ``` !!! In the case where our user is indeed present in the session, we continue executing our script, displaying our page, in which we can use the user's information, like this: !!! well `dashboard.php (fin)` ```html

Bienvenue sur le tableau de bord, !

Déconnexion

``` !!! > Normally at this stage, you have **a working authentication system!** Try entering the correct credentials on the login page, and you should be redirected to the `dashboard.php` page Conversely, if you are not logged in and you try to manually access the dashboard page, **you should be redirected to `login.php` to authenticate!** ### Keeping the user authenticated Even though our authentication works, there's still a problem... > If you completely close your browser, **then you will be automatically logged out** This is clearly not optimal behavior, but for now it's completely normal: as we said, all data contained in the `$_SESSION` superglobal is erased as soon as the browser is closed! So we'll need to use cookies to keep our connection alive for several days! #### What is a cookie? > **These are small pieces of data stored in the user's browser** and sent to the server with every request! This data makes it possible to save persistent information for the user, even after they have left the site. We will use cookies to **remember the user across multiple visits**, and reload the session if necessary! #### Adding a cookie To create the cookie, we will modify our login script **to save the username in a cookie**, in addition to saving it in the session: !!! well `controllers/login.php` ```php function authenticate($username) { // Enregistrer l'utilisateur dans une session $_SESSION['username'] = $username; // Créer un cookie pour mémoriser l'utilisateur pendant 30 jour setcookie('username', $username, time() + (86400 * 30), "/"); // Redirection vers le tableau de bord header('Location: dashboard.php'); } ``` !!! #### Recreating the session from the cookie Now that the information is saved in a durable way, we need to **retrieve the value of this cookie** and recreate the session using it! > Only **if the session doesn't already exist** (for example because the browser was closed). To do this, we'll go back to our `dashboard.php` file and modify the `checkUserAuthenticated()` function like this: !!! well ```php function checkUserAuthenticated(){ // On vérifie que l'utilisateur est présent dans la session if (!isset($_SESSION['username'])) { if(isset($_COOKIE['username'])){ // On vérifie la présence d'un cookie $_SESSION["username"] = $COOKIE["username"]; } else { // Sinon on le redirige vers la page de connexion header('Location: login.php'); exit; } } } ``` !!! ### Logging the user out To allow users to log out, we will create a `logout.php` file that will remove the sessions and cookies. ```php ```

Managing basic authentication