Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an event(s) controller:

class Event extends CI_Controller{

   public function index(){

   public function foo(){

   //Shouldn't be able to use this method unless logged in
   public function bar(){


And I'm trying to organise my code so it's fairly tidy and straightforward. Just now I have a controller named MY_Controller so that only authenticated users can access the methods(edit_event(),add_event()) of any controllers extending it.

However, some of the methods in my controller need to be accessed by unauthenticated users (such as get_event()).

What is a good way of handling this? Should I make two completely separate controllers or extend from the basic event controller and add authenticated methods?

Previously I've had a manager controller that handled all methods which required authentication such as add_user,delete_user,add_doc,delete_doc. But it became blotted very quickly and wasn't easy to update or modify the controller (plus it was messy and didn't seem to follow good programming etiquette).

share|improve this question

How about

public function bar() {
   if (notLoggedIn)
       // display error page
       // perform authorized action

OK, so it's not very sexy, certainly not as fancy as decorating the methods with some thing, but it does have the virtue of giving you full access to the database for authentication purposes, which is more than can be said for, say, the [Authorized] attribute in C#

share|improve this answer
So the Controller class needs to also have access to a notLoggedIn method or property or would this be like a Global Defined variable? – JasonDavis Mar 25 '13 at 23:54
It would be a method or property, most likely from a Repository object. The logic for permissions is part of your Model, not your Controller. – Robert Harvey Mar 26 '13 at 3:03
@Robert Harvey: While I generally agree with this statement, I always like to separate into domain logic and application logic. Imho handling authentication and logins is application logic for the domain and mostly not domain logic itself. – Falcon Mar 26 '13 at 17:13
@Falcon: OK. But if you're writing a backend that you want to be reusable with, say, WPF, wouldn't it be nice if the security logic were already there in your model? – Robert Harvey Mar 26 '13 at 17:14
@Robert Harvey: I have reusable application logic layers above my domain, completely independent of the presentation/service accessing it :-) – Falcon Mar 26 '13 at 17:17

In a medium to large project I separate the controllers. This keeps the implementation of each controller a bit cleaner. And since security should be a core concern, this ensures you never forget to explicitly check the user is logged in. Plus you can easily swap your security implementation later if it needs to change.

share|improve this answer
Right, have different controllers that are coded against the same interface! – Falcon Mar 26 '13 at 10:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.