What should be the correct authorization on php?

Question

PHP

I read many different articles, in the end I was completely confused.
Tell me what should be the simplest but correct authorization on the site.
There is a site in which on index.php I have 2 login and password fields, when the user enters them and they match, there is a redirect to another script like this The idea is that only index.php is open to everyone, and then the user goes through all the redirects the rest of the pages. But only now I realized that the site is accessible without any password via the site.ru/main.php link. I tried to close everything except index.php via .htaccess (I planned to let it in from my own script), but it also doesn’t let me in when redirecting. I also read about the installation method in index.php and checks in other scripts
header("Location: main.php"); exit();
define('HIGHT', true);
if(!defined('HIGHT')) die('access denied');
But it seems that this only works if you include include , and not redirect to another page!?
I understand correctly that in the end I should have all scripts open to everyone (= site pages in my case), but I need to check at the beginning of each page that the user is authorized (using the session mechanism) and is this the only correct option?
Thanks in advance.

Answer 1

It is best to implement site navigation through a design pattern, for example, the most classic MVC / HMVC or component ones. Then you will have only one entry point to the system and you will not have to write checks, includes, etc. in each script.
Further, regarding the authorization itself, there are also a lot of implementation options, but the most minimal and more or less correct option is to organize a check on sessions or cookies, check the presence of a session or cookies by the method, if any, the user is authorized, redirect from the authorization page to the desired one, or dynamically give content, depending on how your system is designed there. If not, give the content of the authorization page or redirect to it. SEO also affects here, if indexing of the authorization page is necessary, then only redirect.
For sessions to work, it is not necessary to include anything, the main thing is that session_start () is always executed at the beginning of the script. As a result, the check will work on all your page scripts, which should redirect if the user is not authorized.

Answer 2

I never get tired of advertising https://github.com/PHPAuth/PHPAuth
I use it myself (and had a hand in it).