How can I check to see if the user is anonymous or logged in from javascript?

Question

I would like to determine whether or not the user is logged in or if they're just anonymous from javascript...

I found this question, but it's php code and I wasn't sure if there is a session variable called logged_in that gets stored on login or if that was just something that person had implemented himself.

Anyone know how I can check to see if the user is logged in from javascript, possibly using ajax?

Edit: I'm running Asp.Net MVC, sorry should have specified

This is so that I can implement a client-side ajax login. When the page loads, I need to know if the user is logged in or not so I can implement something similar to an <asp:LoggedInView> control using jquery.

Thanks,
Matt

Answer 1

You can't read session saved data from JavaScript.

An easy way to do it is to create a JS var from PHP (easier than cookies solution), like this:

if ($_SESSION['logged_in'] == 1) {
    echo '<script type="text/javascript">var logged_in=true;</script>';
} else {
    echo '<script type="text/javascript">var logged_in=false;</script>';
}

Then the JS will simply check the native logged_in var to see if the user is logged in.

<script type="text/javascript">
    if (logged_in) {
        alert("My user is logged in!");
    }
</script>

Answer 2

[DISCLAIMER] Since I've been getting so many comments from people about this being 'bad practice', I'm just going to say this: It IS bad practice to do it this way, but we don't know what the original poster is intending to do. For all we know, he's done everything else 100% correct and secure, and was just asking if there was a way to get at it from javascript. What I have done below is provided my best idea for how to accomplish what he has asked. [/DISCLAIMER]

You can have your php, or whatever backend language you're using, set a cookie that you can then read with javascript.

document.cookie

simple as that. You'll have to search the cookie string for the name of your logged in cookie.

You can also use that to set a cookie and do your logging in through javascript (though probably not the best idea.)

See here for a quick overview of javascript cookie access.

[edit]

To address the issue of a client script having access to session information, and the possible use of ajax suggested in the original question:

Yes, an ajax call would be a very easy way to check this. I'm more of a jQuery guy, so my ajax experience lies there, but basically, you'd do an ajax call to your backend function, and that backend function just checks the 'loggedin' session variable, returning a true or false.

Also, since you now mentioned that you're using jQuery, see this page for easy jQuery cookie access. [/edit]