Protecting Pages Behind Login in PHP

Protected pages require authentication and object-level authorization before returning private content.

What It Does

Protected pages require authentication and object-level authorization before returning private content. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

PHP 8.x and a local test environment. Apply input validation, correct error handling and the requirements of any optional libraries.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Check authenticated session state on the server, not only a hidden navigation link.

<?php
// Execute on an HTTPS page before emitting HTML.
if (session_status() !== PHP_SESSION_ACTIVE) session_start();
if (!isset($_SESSION["user_id"])) { http_response_code(401); exit("Login required"); }
echo "Authenticated account " . (int) $_SESSION["user_id"];

This example depends on an installed extension, third-party library or configured service and is not a standalone local test.

Example 2: Another Case

A logged-in user is not necessarily allowed to view another account's record.

<?php
$session = ["user_id" => 7]; $report = ["owner_id" => 9];
$authorized = $session["user_id"] === $report["owner_id"];
var_dump($authorized);

Practical Example: Putting It to Use

Redirect unauthenticated visitors only to a local trusted login location.

<?php
$redirect = "/login?next=" . rawurlencode("/account/settings");
echo $redirect; // Keep redirect destinations internal or allowlisted.

Important Behavior and Edge Cases

Hiding navigation links or trusting a user ID in a URL is not access control.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• Protected pages require authentication and object-level authorization before returning private content.
• Hiding navigation links or trusting a user ID in a URL is not access control.
• Centralized middleware can enforce login, with additional resource checks in handlers.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.