Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While reading an article I encounter an interesting thing I did not know about:

if(!isset($_SESSION['usr_id']) || !isset($_SESSION['usr_name']))
    header('Location: index.php');

...Which is all well and good if the client respects the Location header. The crawler apparently doesn't, because it doesn't really have to. The bad thing is that any crawler, bot, or browser that can ignore headers could bypass all security on their site.

I do believe that it is true, but I was wondering how I can replicate the results. Basically how can I test that the browser, crawler or something else is ignoring header?

I am not sure whether this question belongs here or to stackoverflow, but I think that due to the nature of this site, there is higher probability that people know how to bypass this.

share|improve this question
I can't help but notice that you're missing a die() or an exit() call after sending the location header. You should stop execution after the client gets redirected. – Maerlyn Mar 2 '13 at 19:52
this is not my code, this is a part of the article, and yes, this should be written in the if statement. – Salvador Dali Mar 2 '13 at 20:17
@Maerlyn that is part of the problem in the article. – ewanm89 Mar 2 '13 at 20:38

First to clarify, the proper description is that the header was "ignored" not "bypassed". A header is a piece of data that is transmitted as a part of an HTTP response, it is not in and of itself a gateway that controls access.

At least one of the comments on the article notes that the the actual issue here is not that that the header was ignored, per se, but that the application failed to exit at the point authentication was denied and send only the header. They continued to build and send the entire response as if the user was properly authenticated, and trust that the client would redirect based on the header without reading the contents of the body. This Is Bad.

The correct behaviour would have been to send only the header (and the corresponding HTTP response code) so that even if a client did chose to ignore it, they would receive no privileged content with the response.

Once the data goes outside of your firewall, it's no longer yours, so you don't send data you wouldn't want someone to have until you've verified who they are.

share|improve this answer

You can test it with cURL extension in PHP or more effective way is to use software that scanning your script and see what action you got.

More than that, you can check it with web server assessment tool:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.