I would like to know what the correct, or recommended, or most common place is to check for expired session, authorization, ACL rights?

In short: do I check


In the controller display method or in view display or should I check in both?

what about the


EDIT: Additional example

I my view.html I include checks like this. (Why? because some examples had them) and I'm starting to get tired of doing this all the time.

if (!$user->authorise('myCom.myAdmin', 'com_myCom') || !$session->isActive()) {
  $app->redirect('/index.php?option=com_users&view=login&return=' .  

1 Answer 1


Session and ACL are two separate concepts, even though they are coupled, so it good to understand the distinction between them. I also assimilate the term permissions with ACL.


Since you are using Joomla as your backbone, the platform is doing the heavy-lifting when it comes to session handling and authentication. The chances that you will need to interact with the session is rather slim (there are use cases, but not expired session). So, a simple answer is: Joomla handles the session for you. You don't have to do a thing.

What happens is that if you require (via ACL) a registered user to perform an action and somehow the session expired, you don't need to to extra checks.


ACL itself can be used in various ways, so there is no simple answer. Here are some basic ideas though.

  • If you want to do a plain check to see if the user is even allowed to access a component, the component main file (for com_example, example.php) would be the place to do it.
  • The more complex are your permissions, you will use them in controllers, views, templates (with a preference to this order, when possible).
  • thanks for the quick reply @Valentin Despa. I added an example into the original question. If I understand you correctly, I don't really need this? at least not the session part.
    – Andreas
    Dec 3, 2014 at 19:59
  • No, you don't need the session part. Also consider redirecting from the controller. Anyway, DO test your app, debug, understand what is happening being the scenes. Dec 4, 2014 at 6:31
  • Redirect in controller, will do, Thanx
    – Andreas
    Dec 5, 2014 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.