CODEWITHSUNDEEP
phpauthenticationhttp-headers
SuperSpy
SuperSpy

Reputation: 1314

Is it safe to use header() to protect/secure a page?

Simple question really. Can I use this to safely shield a page? 

user-only-page.php:

if (isLoggedIn() == false) header('Location: login.php');

isLoggedIn() returns true or false depending on weither the user is logged in or not.

Upvotes: 1

Views: 69

Answers (1)

user3781087
user3781087

Reputation: 419

The header command is executed by the browser rather than the server, so using header relies on the users browser being complicit with your wishes.

When the page is sent to the browser, the content following the header directive is also sent, so the user has access to the remaining content.

With php, you can force the script to end using the exit (or die) function. So the following is good practice:

if (isLoggedIn() == false) {
    header('Location: login.php');
    exit;
}

Upvotes: 1

Related Questions