CodeIgniter 应用中敏感数据保护与认证过滤器的最佳实践

<?php

namespace App\Controllers;

use CodeIgniter\Controller;
use App\Models\EmployeeModel; // 假设有一个员工模型

class LoginController extends Controller
{
    protected $session;

    public function __construct()
    {
        $this->session = \Config\Services::session();
    }

    public function authenticate()
    {
        // 假设这里进行了用户凭据验证
        $employeeModel = new EmployeeModel();
        $employee = $employeeModel->findByCredentials($this->request->getPost('email'), $this->request->getPost('password'));

        if ($employee) {
            $session_data = [
                'id' => $employee->id,
                'name' => $employee->name,
                'email' => $employee->email,
                'isLoggedIn' => true,
                'level' => $employee->level, // 用户权限级别
            ];

            $this->session->set($session_data);
            return redirect()->to('/dashboard'); // 登录成功，重定向到仪表盘
        } else {
            // 登录失败处理
            return redirect()->back()->with('error', '无效的邮箱或密码。');
        }
    }
}

<?php

namespace App\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;

class AuthGuard implements FilterInterface
{
    public function before(RequestInterface $request, $arguments = null)
    {
        // 检查会话中是否存在 'isLoggedIn' 标志
        if (!session()->get('isLoggedIn')) {
            // 用户未登录，重定向到登录页面
            return redirect()->to('/login');
        }
    }

    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
    {
        // 此处通常不需要在认证过滤器中执行任何操作
    }
}

// app/Config/Routes.php
$routes->add('/list_customer', 'Customer::list_customer', ['filter' => 'authGuard']);
$routes->add('/edit_customer', 'Customer::edit_customer', ['filter' => 'authGuard']);
// ... 其他需要保护的路由

<?php

namespace Config;

use CodeIgniter\Config\BaseConfig;
use CodeIgniter\Filters\CSRF;
use CodeIgniter\Filters\DebugToolbar;
use CodeIgniter\Filters\Honeypot;
use CodeIgniter\Filters\InvalidChars;
use CodeIgniter\Filters\SecureHeaders;

class Filters extends BaseConfig
{
    public array $aliases = [
        'csrf'          => CSRF::class,
        'toolbar'       => DebugToolbar::class,
        'honeypot'      => Honeypot::class,
        'invalidchars'  => InvalidChars::class,
        'secureheaders' => SecureHeaders::class,
        'authGuard'     => \App\Filters\AuthGuard::class, // 注册你的认证过滤器
    ];

    public array $globals = [
        'before' => [
            // 'honeypot',
            // 'csrf',
            // 'invalidchars',
        ],
        'after' => [
            'toolbar',
            // 'honeypot',
            // 'secureheaders',
        ],
    ];

    public array $methods = [];

    // 定义要应用过滤器的路由组
    public array $filters = [
        'authGuard' => ['before' => ['dashboard/*', 'customer/*']], // 保护所有以 dashboard/ 和 customer/ 开头的路由
    ];
}

// app/Config/Routes.php
$routes->group('/', ['filter' => 'authGuard'], function ($routes) {
    $routes->get('dashboard', 'Dashboard::index');
    $routes->get('customer', 'Customer::index');
    $routes->get('customer/list', 'Customer::list_customer');
    $routes->get('customer/edit/(:num)', 'Customer::edit_customer/$1');
    // ... 所有需要认证的路由都放在这里
});

// 登录和公开路由不需要认证
$routes->get('/login', 'LoginController::index');
$routes->post('/login/authenticate', 'LoginController::authenticate');
$routes->get('/logout', 'LoginController::logout');

<?php

namespace App\Controllers;

use App\Models\CustomerModel;
use CodeIgniter\Controller;

class Customer extends Controller
{
    protected $session;

    public function __construct()
    {
        $this->session = \Config\Services::session();
    }

    public function list_customer()
    {
        $customer_model = new CustomerModel();
        $data = [];

        // 假设只有管理员或特定用户级别才能查看所有客户
        if ($this->session->get('level') === 'admin') {
            $data['all_customer'] = $customer_model->findAll();
        } else {
            // 普通用户只能看到自己负责的客户或与自己相关的数据
            // 假设客户模型中有一个 'employee_id' 字段关联员工
            $loggedInUserId = $this->session->get('id');
            $data['my_customers'] = $customer_model->where('employee_id', $loggedInUserId)->findAll();
            // 或者根据其他业务逻辑过滤
        }

        return view('list_customer', $data);
    }

    // ... 其他方法
}