Path: csiph.com!news.mixmin.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: "Christoph M. Becker" Newsgroups: comp.lang.php Subject: Re: Redirection question Date: Wed, 6 Jul 2016 14:00:56 +0200 Organization: solani.org Lines: 32 Message-ID: References: <34d681f8-c97e-462a-ad6d-d21abb77f20d@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: solani.org 1467806455 32677 eJwFwYEBgDAIA7CXZLRFzoEJ/59gQpfpBkSByz3m4NnJieYIvih/oC2rfmE7cVEfs9NS7T8VuBEF (6 Jul 2016 12:00:55 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Wed, 6 Jul 2016 12:00:55 +0000 (UTC) User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 X-User-ID: eJwFwQkBACAIA8BKPBtgHEXpH8E7emh0IhjgcGDWxu3wOndE6Su95sldXZap+41y5MBCUfwIqxBA In-Reply-To: <34d681f8-c97e-462a-ad6d-d21abb77f20d@googlegroups.com> Cancel-Lock: sha1:s7/yPhWTQw33ZIE7fJiF4Bk1yC4= X-NNTP-Posting-Host: eJwFwQkBwDAIA0BLhPDEzkqLfwm7SxZqOiorcnPxzH2RzYDYxyHpnSZip41zP8DEveOepR/7RRAF Xref: csiph.com comp.lang.php:16831 On 06.07.2016 at 13:00, bit-naughty@hotmail.com wrote: > However with the 2nd approach, can't someone just *discover* the > "logged in" HTML page in the directory on the server and simply *go > to* "site.com/loggedin.html" and wreak all kinds of havoc? Well, of course anybody could request the "logged in" URL, but in case the visitor is not logged in, the page simply shouldn't tell them that they are, e.g. if (is_user_authenticated()) { echo "Hi $name, you're logged in!"; } else { echo "You are not logged in."; } Note that it's mandatory that you check the authentication (and authorization) on *each* request anyway. See for details. > Not to > mention that I don't even know HOW to code a redirect in PHP - what's > the HTTP code even? :) A relatively small niggle, but still, it IS > extra effort....? You just have to send the proper Location header field, see . -- Christoph M. Becker