CODEWITHSUNDEEP
javascriptphphtml
superiorpancakes
superiorpancakes

Reputation: 9

delay or prevent loading until php script / javascript has fully executed

I have an Auth script at top of my php/html pages on my website to redirect people when they try to access protected content without being logged in. The issue I am having is that content in the protected area link is unintentionally loaded and in a flash information can be seen before the window.location.href redirects user to the default login page. This creates a security vulnerability where protected info can be seen for a fraction of a second on whatever page they are trying to access from the outside.

Is there a way to make it so the protected content doesn't load until after the auth script is thoroughly executed?

require_once('userSessionAuth.php')

 alert("You are not logged in!");
 window.location.href="http://example.com/customerlogin.php";

^^All the protected content is listed after these two lines on all my protected pages.

Upvotes: 0

Views: 104

Answers (2)

Madbreaks
Madbreaks

Reputation: 19539

Do the redirect on the server side instead of returning any content to the client:

<?php
// check for auth, if not authenticated then:
header('Location: "http://example.com/customerlogin.php');
exit;
?>

Docs here: http://php.net/manual/en/function.header.php

Upvotes: 3

Meroje
Meroje

Reputation: 344

Your actual problem is the protected content is sent anyway.

Use the header function to send a Location redirect and exit your script right after.

Upvotes: 0

Related Questions