Hi Reen,
I'm glad you enjoyed the video! I really appreciate your feedback about this project. Let me respond to your comments:
Reen wrote:Hi Jon,
It's not the responsibility of a user to authenticate it's self. Like a car should not be able to put a traffic light on green. The logic for authentication should be in the authentication class. You can add a non-static function called verifyPassword, and call that function from the authentication.
The user is not authenticating himself, the use Model, however is. I'm also using the Model_User class as a method of storing any business rules related to authentication. If the code were in the authentication class, it would couple the database querying engine (in this case Doctrine) to the authentication code. Alternatively, a data-table gateway could've been implemented so that the Model_User class could be used exclusively as a value-object. This, of course, would add to the complexity of the implementation in an area that the video wasn't focused.
Reen wrote:Type of exceptions should not be checked by exception message. You can subclass the exception class and check it's type by using instanceof.
There's been a lot of debate about this within the Zend community, however you're absolutely right that a OOP purist would do type checking rather than error code checking. However, the disadvantage to such heavy Exception class implementations is that you start creating Exceptions for every single outcome, my own experience of seeing hundreds of lines of catch blocks in Java has led me to prefer a error-code-based comparison, using the Exception model for more generic exception handling. Furthermore, having multiple exceptions and then explaining their use would blur the overall focus of the video, which is the Zend_Controller implementation.
Reen wrote:Things you probably said in the video:
- Passwords should be hashed (with seed);
- It is bad practice to show difference between incorrect user and incorrect password, hackers will be able to use your login interface to check for existing users.
Hope this feedback helps. Keep up the video-tutorials they are great!
Cheers
Thanks for mentioning the passwords here. Of course passwords should be hashed! Preferably with a salt as well. This is mentioned in the video.
In terms of it being a bad practice to say a user is not found, I've never found or read anything of the sort. I've also seen this functionality widely used in web applications. I would also conjecture that a hacker could use a registration interface to discern the same data.
