Security in php failing

Question

I created a small security code for my login system, to prevent people from composing the administrative panel link and pasting and being able to access it.

    <?php
ob_start();
if(($_SESSION['usuarioNome'] == "") || $_SESSION['usuarioNivelAcesso'] == ""){
    $_SESSION['loginErro'] = "Área restrita para usuários cadastrados";
    header("Location: login.php");
}
?>

This section above is what you see if the person copied the link or accessed normal. However I copy and paste the link and access usually administrative page.

Some solution?

Answer 1

This code will not work if you have already logged in and filled in these values in the session. The session exists on the server, regardless of what you do in the browser, and only dies after certain time without user activity or when it is explicitly cleared.

If you want the person not to be able to access by pasting a link, you need to do the following sequence of steps:

• Generate a session value (with a name different from those that store a user name and access level, in your case) on any other page. Name it as an access token or something;
• On the admin page, see if that value in the specific session is filled in. If you are, allow access, otherwise redirect to another page;
• Finally, still on the admin page, after the above check, delete the value. This causes the next access to the admin page to be redirected. Now you will only be able to access the admin page after accessing the token generator page again.

Editing to add code

On any page, other than the panel, add the following logic:

$_SESSION['autorizacaoPainel'] = true;

On the panel page, add the following logic:

if ($_SESSION['autorizacaoPainel']) {
    unset($_SESSION['autorizacaoPainel']);
} else {
    header("Location: login.php");
}

So you will always need to access the page you fill 'autorizacaoPainel' before any access to the panel.