I'm creating a user portal for our customers but I'm yet to find the best way to check if a user is logged in or not. I used to check it by setting some session variables with my authenticate() function if the user is allowed to visit the page:public function authenticate($customerId, $password) {    $user = $this->findById($customerId);    if(!$this->pkdf->verify_password($password, $user->getHash())) {        return false;    }     $_SESSION['user']['customerid'] = $user->getId();    $_SESSION['user']['email'] = $user->getEmailNormal();}Then I check withif(!isset($_SESSION['user']) {     // logout code }But someone said to me that I should not be using session variables for authorization, and instead I should take a look at access tokens in the header. Or is using sessions fine for this purpose? I don't know where to look further. Can anyone push me into the right direction?
Check if a user is authorised to visit a page
php;session;authorization