FuelPHP Forums

Hi Jemlmer, Thanks for your valuable answer. Can I have table name of my own choice. Regarding checking the user_id, login_hash etc needed to checked in login Auth::check method am I right. It may be a silly question for your reputation. Little confusion in implementing as a beginner. Advance thanks..

Hi guys! I have 2 questions... 1. Would you have to extend Auth::check()? 2. Could I use that hash to generate a token for "forgot my password reset"?
2b. Do you guys have a recommendation on how to do "password resets"?

thanks WanWizard, 1. But if i'm checking another table for multiple hashes... Where would I put this logic? User_Model? I feel like that moves away from the Auth package. in my opinion, the auth package should have a way to keep multiple logins, maybe as a config setting... any thoughts? 2. What if the user forgets the username? What I was thinking was that an email with a link to a reset page + token, that asks for the email address again and a new password. This change should be done through the User model right? The Auth package requires the old password.

1. That's why I said: only if you need a different method of checking. Which obviously you do. 2. If someone is able to capture the email, they can hijack the account as they would have both the link with the token and the email address. So you should ask for something not in the email, preferably something the hijacker can not know. Maybe store a verification question and answer? (like "what what the name of your first pet" => "godzilla" ). To use my own user database, I've added a new auth driver to replace simpleauth. All you have to do is make sure the required methods are there, add the ones you need extra, and replace the logic in perform_check() so it does your checks against your database colums. If you do this, you can continue to use the standard Auth methods, which will automatically use your custom driver.

I would like to see a default auth package with multiple login and driver (facebook, twitter, oauth, oath2, etc.) And also have a choice to use username, email or both as login method.

Feel free to write it and pull-request, sounds like an awesome package to include as a more complex option. This is a community project after all...

The table should have the login_hash, the user_id, the login-time and possibly the user's IP and user agent. What you do after that is check if there's a row in your logins table for which the login_hash, user_id (and possibly IP, user_agent) match the current user's cookie. Also have it expire when the login-time is too long ago, or use an expire column that is set to the time the login will expire.
Have your table periodicly run a cleanup query that deletes all expired rows, I have that done when a user logs in succesfully but you could put that in other places as well (just don't do it in the login-check method, that's needed way too often).

Thank you Jelmer!