Login System Overview

What is a Login System?

A login system is a security mechanism that verifies user identity (authentication), controls access to resources (authorization), maintains user sessions across requests, and protects sensitive information.

Think of it like a building with a security desk: registration is like getting an ID card, logging in is showing your ID to enter, the session is wearing a visitor badge while inside, and logging out is returning your badge and leaving.

---

Core Components

A complete login system has three main components:

1. User Registration: creating new user accounts, collecting user information, and storing passwords securely.
2. User Login: verifying user credentials, creating authenticated sessions, and managing user state.
3. User Logout: destroying sessions, clearing user state, and performing security cleanup.

Each of these is covered in detail on its own page.

---

Authentication vs Authorization

These two concepts are often confused but serve different purposes.

Authentication answers the question “Who are you?” It involves verifying user identity by checking credentials (email + password) and creating sessions after a successful login.

Authorization answers the question “What can you do?” It involves checking user permissions, enforcing role-based access control (e.g., Admin vs Customer), and protecting specific resources.

For example, a user logs in with their email and password (authentication). Once logged in, an admin user can access /admin/dashboard, but a regular customer cannot (authorization).

---

Why Sessions Matter

HTTP is a stateless protocol. Without sessions, the server would forget who the user is after every single request:

Without sessions:
  Request 1: User logs in       (OK)
  Request 2: User visits /dashboard  (Who are you? Login again!)
  Request 3: User visits /profile    (Who are you? Login again!)

With sessions:
  Request 1: User logs in       (Session created)
  Request 2: User visits /dashboard  (Session remembers user)
  Request 3: User visits /profile    (Session remembers user)

Sessions solve this by storing user data on the server and identifying the user through a session ID cookie sent with each request.

---

File Structure

Here is the MVC organization you will build across the authentication labs:

app/
├── Controllers/
│   └── AuthController.php (register, login, logout, dashboard)
│
├── Domain/Models/
│   └── UserModel.php (create, find, authenticate)
│
├── Middleware/
│   ├── SessionMiddleware.php (global session management)
│   ├── AuthMiddleware.php (login check)
│   └── AdminAuthMiddleware.php (role check)
│
├── Views/
│   ├── auth/ (register.php, login.php)
│   └── user/ (dashboard.php)
│
└── Routes/
    └── web-routes.php (route definitions)