screenlock function and event afterScreenLock

[datamweb]

Hello friends.
I think it would be very interesting to have a screenLock function and event afterScreenLock in the shield.
The function of this action is to temporarily exit the user and transfer to a page that requires only a password to login.
Like a lock on Windows.
Is such a possibility considered?
If yes, please enter an address for review.
If not, what is your opinion?

[lonnieezell]

That's an interesting name for it, but yes I think something like this would be good. I've always thought of it as a "confirm identity" feature, but the ability to double-check someone's credentials before accessing a certain page would be a good addition.

I could see it being used in a controller method or via a controller filter.

This probably won't happen until after the initial release, though.

[MGatner]

My original Auth package in CI3 stored a credential "level" with the user ID, and then all authorizations could carry a minimum level with them. Levels would be something like active session, remembered cookie, credential login, 2FA... then if you tried to access a part of the site with a higher level you would need to meet that limitation.

This approach was nice in that you never needed to 2FA for basic stuff, and you could be comfortable using a really long remember cookie knowing users would need to re-auth to do things like change their account settings.

I don't know that this solves the screen lock idea - maybe a controller endpoint that "downgraded" the stored level? But I'm also not sure how this screen lock idea is different from logging out.

[datamweb]

This probably won't happen until after the initial release, though.

@lonnieezell I know you and MGatner and Kenjis have spent a lot of time on shield.
I'm glad that after years, a user login system will finally be added to the CI.
I believe that part of the lost popularity of Codigniter will be restored, at least in my country.
I thank all of you here.

[datamweb]

But I'm also not sure how this screen lock idea is different from logging out.

In screenLock after logout, it is not possible to access the user panel at all.
But when you go to the login page for login. The value of field validFields will be set and does not need to be re-entered by user.
for login, only the password is entered (magic link or fixed password).
I'm sorry english not good I hope you understand what I'm saying.