authentication - Possible to switch a large PHP backend from HTTP Auth to a session-based system? -

i'm working add better authentication system mature backend site. i've been using http authentication because it's easy setup. site has grown, downsides method have become more , more pronounced; specifically, lack of security on standard http connections, , lack of standard mechanism log users out.

i've read on every php authentication question can find on so, still haven't found satisfactory solution upgrading large existing codebase use session-based system. takeaway answers seems be:

1. don't roll own if don't know you're doing
2. session-based authentication really involved subject

i have rolled own user registration system before, , indeed, seems woefully insecure looking @ now. can see taking months polish, when want doing working on backend itself.

i imagine common problem. pretty every website i've built has required @ least minimal backend, , think few developers have chops ("expertise") build airtight system.

i've looked @ solutions using zend framework, codeigniter, , cakephp — presume specific coding style (or seems), , prospect of reorganizing of code is, in word, deflating. (and beyond that, inefficiency of including 1 of these massive frameworks just authentication rubs me wrong way.)

is there better solution? can isolate authentication class 1 of these frameworks? (because backend site (closed), don't need worry registration, or captchas — or of ancillary features of authorization system.)

thanks consideration.

yes, possible , can moderately straightforward. key need isolate all security checks in few places possible, ideally in common files. don't want copy same security-oriented code on place.

the structure of session-based login system 3 pieces:

1. the session setup
2. the security confirmation
3. the login page

the first 2 require have common set of files all pages include. projects have these; things setup database connection , load utility classes or functions. somewhere in that, need add session_start(). can use sessions (the $_session superglobal).

also in these common files , after session started, need check session says user logged in (and has). if are, can setup whatever global structures pages need work current login.

if session says not logged in, common files need hijack page request , redirect user login page. login page can , should use common structure, needs set control variable bypass security check, because user (obviously) not logged in. need same thing process post login screen boring password checks, setup session they're logged in , redirect either default page or whichever page trying go to.