php - How to effectively delete a user as an admin

Solution:

You cannot delete the user's session/cookie on their side... but what you can do is immediately remove their ability to do anything admin-ish.

If the user's credentials are re-checked on the server (based on their sessionID or whatever) prior to any admin-level action, then their admin status is effectively disabled - and you would then transfer them to a non-admin screen at the same time.

You might ask: What if they have the admin screen up and active when I nuke them? There is little you can do about a static screen (they can take a screenshot - you cannot prevent that). They can hit the back button and perhaps view a screen from cache. But

Some possible solutions are:

(a) Use ajax with a setInterval (or recursive setTimeout) function to re-check their admin credentials with the server every X seconds/minutes. Then, even if they are afk they can be logged out of the admin screen. (Of course, this method can be halted by a savvy user by monkeying in DevTools.)

(b) Before any admin action is executed, their creds are re-checked. If they are no longer an admin, the action is refused AND they are returned to a non-admin screen. This method cannot be interfered with by a savvy user.

Won't this introduce a noticeable delay to everything?

No. Re-checking the creds is as simple as live-checking their user-privilege status in your database.

When you de-adminize them, you will change their priv level, so this will be picked up immediately whenever the user tries to do something from that admin screen. Unless you have several thousand users, don't worry about the overhead of doing this. Even with several thousand users, it is still probably a decent way of handling the matter. You are communicating with the server at this point anyway, and within each admin-action function, just insert a quick check to "verify admin status" - so it is just back-end code on the server communicating with its own database. Super quick.

Didn't find the answer?

Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.