User Authentication Features

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• login/login_process.php
• database/db_connection.php
• models/User.php
• controllers/AuthController.php

Introduction

The User Authentication system in the TAMV Online project serves as the foundational security layer for the application. Its primary purpose is to verify the identity of users attempting to access the platform and to manage session state across various modules. By centralizing credential validation and session management, the system ensures that sensitive project data is only accessible to authorized personnel.

This module integrates closely with the database layer to perform secure lookups and maintains session persistence using standard web protocols. It handles the lifecycle of a user session from the initial login request through to termination via logout.

Sources: README.md:1-2, login/login_process.php

Authentication Architecture and Data Flow

The authentication architecture follows a classic Client-Server pattern involving a frontend interface, a processing controller, and a backend database. The system utilizes PHP sessions to track authenticated users across different page requests.

Authentication Process Flow

The following diagram illustrates the sequence of events when a user attempts to log in to the system:

Database Integration and User Model

The system relies on a dedicated database connection and a User model to abstract data access. The db_connection.php file manages the connection string and environment-specific configurations to ensure secure database communication.

User Data Structure

The User class typically handles the following attributes retrieved from the database:

Field	Type	Description
id	Integer	Unique identifier for the user
username	String	Unique login name
password	String	Hashed representation of the user password
role	String	User permissions level (e.g., Admin, User)
last_login	DateTime	Timestamp of the most recent successful authentication

Sources: models/User.php, database/db_connection.php

Security Implementation

Security is maintained through several key mechanisms:

1. Password Hashing: The system does not store plain-text passwords. It uses secure hashing algorithms to store and verify credentials.
2. Session Security: Authentication tokens are stored in server-side sessions to prevent client-side tampering.
3. Input Sanitization: Data received from the login forms is filtered to prevent SQL injection and Cross-Site Scripting (XSS) attacks.

API and Endpoints

The authentication module exposes specific endpoints for managing user state:

• POST /login: Validates user credentials and starts a session.
• GET /logout: Destroys the current session and redirects to the login page.
• GET /check-session: Internal utility used by other modules to verify if a user is still logged in.

Sources: controllers/AuthController.php, login/login_process.php

Conclusion

The User Authentication Features provide a robust entry point for the TAMV Online project. By utilizing secure hashing, session management, and a structured MVC approach with the AuthController and User model, the system ensures that user identities are protected and verified consistently throughout the application lifecycle.