Handling session resources in MY_Controller with Codeigniter I've added a function that checks if the user is trying to use/access something which requires a session. I'd love to hear some criticisms of my choice of design.

class MY_Controller extends CI_Controller {

    function __construct() {
        parent::__construct();
        if(!$this-&gt;input-&gt;is_ajax_request()) {
            if(!$this-&gt;session-&gt;userdata('is_logged_in')) {
                $this-&gt;load-&gt;view('header_public_view');
                if($this-&gt;login_required())
                  //do something, redirect etc..
            }
            else {
                $this-&gt;load-&gt;model('user_model');
                $data['user'] = $this-&gt;user_model-&gt;get_user($this-&gt;session-&gt;userdata('userid'));
                $this-&gt;load-&gt;view('header_user_view', $data);
            }
        }

    }

    function login_required() {
        if($this-&gt;uri-&gt;total_segments() &gt; 3)
            $request = $this-&gt;uri-&gt;segment(3);
        else
            $request = $this-&gt;uri-&gt;segment(2);
        foreach(unserialize(SESSION_RESOURCES) as $required) {
            if($request == $required)
                return true;
        }
    }

}
You don't really need to check for is_logged_in.  If you destroy/build the session data correctly all you should care about is "Does a user id exist in the session?", then you can let your main controller handle the rest.

class MY_Controller extends CI_Controller{

    //here we just build some constants to check against values
    //in the permissions array
    const PERM_READ = "read";
    const PERM_EDIT = "update";
    const PERM_DELETE = "delete";

    //here we let the main controller take care of our auth/permissions/roles etc
    //first check if a user id exists in the session
    //if so assign a user, group, permissions and check for authentication where
    //you need it ( ie: child controllers)

    protected $_user, $_group, $_permissions = array();

    public function __construct(){
        parent::__construct();

        //check for a user id in the session
        $this-&gt;user = ( $this-&gt;session-&gt;userdata('uid') )
                    ? User::find_by_id( $this-&gt;session-&gt;userdata('uid') )
                    : NULL;

        //if user exists assign permissions and group
          if ($this-&gt;user !== NULL) {
              $this-&gt;_assign_group();
              $this-&gt;_assign_permissions();
              $this-&gt;_check_for_banned_users();
          }

    }

    protected function _assign_group() {
        return $this-&gt;group = $this-&gt;user-&gt;group-&gt;name;
    }


    // {["read", "update", "delete"]}
    protected function _assign_permissions() {
        return  $this-&gt;permissions = json_decode($this-&gt;user-&gt;permissions);
    }

    protected function _check_for_banned_users() {
        if ($this-&gt;group === 'banned') {
            show_error('You have been banned from this website!');
            return;
        }
    }

    protected function _can_read(){
        return (bool) ( in_array( self::PERM_READ, $this-&gt;permissions) );
    }

    public function _can_edit(){
        return (bool) ( in_array( self::PERM_EDIT, $this-&gt;permissions) );
    }

    public function _can_delete(){
        return (bool) ( in_array( self::PERM_DELETE, $this-&gt;permissions) );
    }
} 


This might give you some idea, as your user table won't look like that, I'm sure.

Now, you have control over any child classes.

class some_child extends MY_Controller{

     public function __construct(){
         parent::__construct();
     }
     public function show_something(){

          if($this-&gt;is_ajax_request()){
              if($this-&gt;user &amp;&amp; $this-&gt;_can_read()){
              //yes a user exists and is logged in,
              //yes he has permission to read from this section
              $this-&gt;load-&gt;view('some_view');
              }
          }
          else
             show_404();
     }
}


Just be careful to destroy your session properly.

function logout(){
    $this-&gt;session-&gt;set_userdata(array(
         'uid'  =&gt; 0,
         //any others you created upon user login
    ));
    return (bool) $this-&gt;session-&gt;sess_destroy();
}