Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #16831
| Path | csiph.com!news.mixmin.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail |
|---|---|
| From | "Christoph M. Becker" <cmbecker69@arcor.de> |
| Newsgroups | comp.lang.php |
| Subject | Re: Redirection question |
| Date | Wed, 6 Jul 2016 14:00:56 +0200 |
| Organization | solani.org |
| Lines | 32 |
| Message-ID | <nlirtn$vt5$1@solani.org> (permalink) |
| References | <34d681f8-c97e-462a-ad6d-d21abb77f20d@googlegroups.com> |
| Mime-Version | 1.0 |
| Content-Type | text/plain; charset=utf-8 |
| Content-Transfer-Encoding | 7bit |
| X-Trace | solani.org 1467806455 32677 eJwFwYEBgDAIA7CXZLRFzoEJ/59gQpfpBkSByz3m4NnJieYIvih/oC2rfmE7cVEfs9NS7T8VuBEF (6 Jul 2016 12:00:55 GMT) |
| X-Complaints-To | abuse@news.solani.org |
| NNTP-Posting-Date | Wed, 6 Jul 2016 12:00:55 +0000 (UTC) |
| User-Agent | Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 |
| X-User-ID | eJwFwQkBACAIA8BKPBtgHEXpH8E7emh0IhjgcGDWxu3wOndE6Su95sldXZap+41y5MBCUfwIqxBA |
| In-Reply-To | <34d681f8-c97e-462a-ad6d-d21abb77f20d@googlegroups.com> |
| Cancel-Lock | sha1:s7/yPhWTQw33ZIE7fJiF4Bk1yC4= |
| X-NNTP-Posting-Host | eJwFwQkBwDAIA0BLhPDEzkqLfwm7SxZqOiorcnPxzH2RzYDYxyHpnSZip41zP8DEveOepR/7RRAF |
| Xref | csiph.com comp.lang.php:16831 |
Show key headers only | View raw
On 06.07.2016 at 13:00, bit-naughty@hotmail.com wrote:
> However with the 2nd approach, can't someone just *discover* the
> "logged in" HTML page in the directory on the server and simply *go
> to* "site.com/loggedin.html" and wreak all kinds of havoc?
Well, of course anybody could request the "logged in" URL, but in case
the visitor is not logged in, the page simply shouldn't tell them that
they are, e.g.
if (is_user_authenticated()) {
echo "Hi $name, you're logged in!";
} else {
echo "You are not logged in.";
}
Note that it's mandatory that you check the authentication (and
authorization) on *each* request anyway.
See <https://www.owasp.org/index.php/Session_Management_Cheat_Sheet> for
details.
> Not to
> mention that I don't even know HOW to code a redirect in PHP - what's
> the HTTP code even? :) A relatively small niggle, but still, it IS
> extra effort....?
You just have to send the proper Location header field, see
<http://php.net/manual/en/function.header.php>.
--
Christoph M. Becker
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Redirection question bit-naughty@hotmail.com - 2016-07-06 04:00 -0700 Re: Redirection question "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-07-06 14:00 +0200 Re: Redirection question gordonb.bwo97@burditt.org (Gordon Burditt) - 2016-07-06 19:40 -0500
csiph-web