Authentication Plugin

[PrettyBrutalXperience-Guy]

Helloworld,

Not a seasoned PHP developer and I've had a hard time finding any documentation around the authentication system (though poking around I'm pleased with how its engineered), yet somehow managed to hack together an authentication plugin by ripping parts out of and then adding to one of the available plugins.

Many moons later, I would now like to take a more scientific approach in order to benefit from update/upgrades without having to go full dexter.
With the new, clean, calculated approach, in the positive cases where a user is properly authenticated they log in and everything works fine, but if the user isn't valid then a redirect loop leads to fail2ban blocking my IP.

What I'm trying to achieve is simply to redirect the user someplace else if they're not authenticated. As I'm typing this I'm thinking of perhaps sending them to the 'dashboard' as a public user, but am open to other suggestions.

For reference, the clean version is more or less this, and the hacked together version is that except at the end if not authenticated the logic from the database plugin is copy pasted such that the normal authentication prompt is shown.

Any/all help is appreciated.

 

[PrettyBrutalXperience-Guy]

Found something good enough for my purposes as neither HTTP nor HTML redirects worked as expected, only caveat to the below is expects javascript to not be disabled (is disabling javascript still a thing?):

if ($this->authorized != true) { echo '<script>window.location.href = "https://mywebsite.com/whyamiseeingthis.html";</script>'; die(); }

Also considering creating a 'dummy user' with only permission to view the dashboard where I can publish content. So if the user isn't authenticated they'd be granted the identity of this dummy user and land on the dashboard where I can publish stuff.

I lied, an HTML redirect will work if I use die() to kill further proccessing of PHP, the HTTP redirect likely isn't working because its too late in the game, headers have already been passed.
if ($this->authorized != true) { echo '<meta http-equiv="refresh" content="0;url="https://mywebsite.com/whyamiseeingthis.html">'; die(); }

That being said, I'm still open to ideas or suggestions. It still feels hacky, but at least its a few hundered less lines and nothing is recylced/copy pasted.