Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking into making a correctly laid out MVC Auth/ACL system. I think I want the authentication of a user (and the session handling) to be separate from the ACL system. (I don't know why but this seems a good idea from the things I've read.)

What does MVC have to do with this question you ask? Because I wish for the application to be well integrated with my ACL. An example of a controller (CodeIgniter):

class forums extends MX_Controller
    $allowed = array('users', 'admin');
    $need_login = true;

        function __construct()
        //example of checking if logged in.
            if($this->auth->logged_in() && $this->auth->is_admin())
            echo "you're logged in!";
    public function add_topic()
            //some add topic things.
            echo 'not allowed to add topic';

My thoughts

$this->auth would be autoloaded in the system. I would like to check the $allowed array against the user currently (not) logged in and react accordingly.

Is this a good way of doing things? I haven't seen much literature on MVC integration and Auth. I want to make things as easy as possible.

share|improve this question

My approach within Zend Framework has been to have a base class of SecureController which all controllers that require authentication must extend. In the SecureController I have a pre-dispatch authentication check for whether a user is logged in else forward to the login page.

After the login check is completed, I then carry out an authorization check whether the user can access the resource and action, the controller is usually tied to a single resource (but this behavior can be overridden) and the controller action can be mapped to a resource action.

With this in place, the only thing I need to do in each child controller is map the resource and action to what is being done without ever having to invoke the security checks again.

If I need specific ACL checks especially in view generation I can use the Zend_ACL instance that is tied to the user's session

share|improve this answer
this was definitely a very popular answer when it was written, but if you're coming across this question in 2016, this stuff is mostly handled with middleware. – Andrew Brown Mar 25 at 23:08

I tried to come-up with my own explanations, but i found a really comprehensive post in the middle of compiling my answer. Hopefully you will find more than you asked in this post - PHP ACL implementation

Edir: Basically, idea behind the post suggest to use use decorator pattern (look at Wiki for more info). In simple concept this pattern recommend to take your object, and place it inside another object, which will act like a protective shell. In this way, your code would not be required to extend the original class.

share|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Yannis Jul 9 '12 at 16:16
Essential idea is added, please enjoy the reading. – Yusubov Jul 10 '12 at 1:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.