Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #16831

Re: Redirection question

Show all headers | View raw

On 06.07.2016 at 13:00, bit-naughty@hotmail.com wrote:

> However with the 2nd approach, can't someone just *discover* the
> "logged in" HTML page in the directory on the server and simply *go
> to* "site.com/loggedin.html" and wreak all kinds of havoc?

Well, of course anybody could request the "logged in" URL, but in case
the visitor is not logged in, the page simply shouldn't tell them that
they are, e.g.

  if (is_user_authenticated()) {
      echo "Hi $name, you're logged in!";
  } else {
      echo "You are not logged in.";
  }

Note that it's mandatory that you check the authentication (and
authorization) on *each* request anyway.

See <https://www.owasp.org/index.php/Session_Management_Cheat_Sheet> for
details.

> Not to
> mention that I don't even know HOW to code a redirect in PHP - what's
> the HTTP code even? :) A relatively small niggle, but still, it IS
> extra effort....?

You just have to send the proper Location header field, see
<http://php.net/manual/en/function.header.php>.

-- 
Christoph M. Becker

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Redirection question bit-naughty@hotmail.com - 2016-07-06 04:00 -0700
  Re: Redirection question "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-07-06 14:00 +0200
  Re: Redirection question gordonb.bwo97@burditt.org (Gordon Burditt) - 2016-07-06 19:40 -0500

csiph-web