Where is the right place to check for ACL / Session expired / permissions?

Question

I would like to know what the correct, or recommended, or most common place is to check for expired session, authorization, ACL rights?

In short: do I check

!$session->isActive() 

In the controller display method or in view display or should I check in both?

what about the

$user->authorise('example.canDo','com_example')

EDIT: Additional example

I my view.html I include checks like this. (Why? because some examples had them) and I'm starting to get tired of doing this all the time.

if (!$user->authorise('myCom.myAdmin', 'com_myCom') || !$session->isActive()) {
  $app->redirect('/index.php?option=com_users&view=login&return=' .  
  urlencode(base64_encode($this->currPageUrl)));
}

Answer 1

Session and ACL are two separate concepts, even though they are coupled, so it good to understand the distinction between them. I also assimilate the term permissions with ACL.

Session

Since you are using Joomla as your backbone, the platform is doing the heavy-lifting when it comes to session handling and authentication. The chances that you will need to interact with the session is rather slim (there are use cases, but not expired session). So, a simple answer is: Joomla handles the session for you. You don't have to do a thing.

What happens is that if you require (via ACL) a registered user to perform an action and somehow the session expired, you don't need to to extra checks.

ACL

ACL itself can be used in various ways, so there is no simple answer. Here are some basic ideas though.

• If you want to do a plain check to see if the user is even allowed to access a component, the component main file (for com_example, example.php) would be the place to do it.
• The more complex are your permissions, you will use them in controllers, views, templates (with a preference to this order, when possible).