Sessions, the customer and login checks

A session is storage that keeps data of one visitor between requests: the chosen currency, the id of the order being placed, the fact of login. The customer object tells who this visitor is. Both are needed as soon as a page behaves differently for a guest and for a logged-in customer.

The session

Session data is the array $this->session->data. Whatever is written there is available in the next requests of the same visitor:

// extension/acme_hello/catalog/controller/module/acme_hello.php, in index()
$this->session->data['acme_hello_views'] = ($this->session->data['acme_hello_views'] ?? 0) + 1;
 
$data['views'] = $this->session->data['acme_hello_views'];

Print {{ views }} in the module template and reload the home page several times — the number grows: 1, 2, 3. In another browser the count starts again.

A value is removed with unset($this->session->data['acme_hello_views']).

Keys the core keeps in the session:

Name your own keys with the prefix of the extension so they do not clash with these.

The customer object

$this->customer exists only on the storefront. Its class is in system/library/cart/customer.php.

$data['name'] = $this->customer->isLogged() ? $this->customer->getFirstName() : '';

{% if name %}
  <p>{{ text_hello|format(name) }}</p>
{% endif %}

Log in on the storefront at index.php?route=account/login and open the home page — the module greets you by name. A guest does not see the line.

A page for logged-in customers only

public function history(): void
{
    $language = 'language=' . $this->config->get('config_language');
 
    if (!$this->customer->isLogged()) {
        $this->session->data['redirect'] = $this->url->link('extension/acme_hello/module/acme_hello.history', $language);
 
        $this->response->redirect($this->url->link('account/login', $language));
    }
 
    // the page for the customer
}

Open index.php?route=extension/acme_hello/module/acme_hello.history as a guest — the login page opens. The key redirect tells the login page where to return after a successful login.

The customer token

Account pages of the core in version 4 also check customer_token in the address — the storefront counterpart of the admin user_token. A link to such a page includes it:

$account = $this->url->link('account/account', $language . '&customer_token=' . $this->session->data['customer_token']);

Whether a particular page requires the token depends on the release — look at the start of its controller in catalog/controller/account/.

Common mistake

Records are selected by an id from the address without checking the owner: ...&callback_id=15 shows another customer's request. For a logged-in customer always add the condition customer_id = (int) $this->customer->getId() to the query — never trust an id that came from the request alone.