1

When redirecting using header("Location MyPage.php"); in PHP, any code present after will be executed. So, if you're using this as a way to avoid user accessing pages where they should be logged in, the content of the page will still be processed and sent to the client. Using a proxy, you can set that despite returning a 302 error code, you'll also get the content of the page.

My question is, what other languages or framework have this issue ?

3
  • This isn't a language security issue, it's a poor programming issue. And you can write bad code in any language. – Alfred Armstrong Oct 28 '19 at 11:34
  • @AlfredArmstrong it's much easier to do poor programming with specific languages. With PHP, the code after is still executed, but maybe it won't be the case if you use an equivalent function in another language, or in a framework. – user96649 Oct 28 '19 at 13:56
  • I bet I could write equivalently bad code in any language you care to name. Don't expect languages to save you from a shortfall in understanding, they can't. – Alfred Armstrong Oct 28 '19 at 14:04
1

Likely (almost?) any framework which does not stop executing the code after the Location header is sent behaves that way. It is perfectly fine from the perspective of HTTP that a response with a location header also has a HTTP body. It is also perfectly normal that the web application might need to do more processing even after issuing the redirect.

So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...

You should never treat a user as authenticated if the user is not actually authenticated. Simply adding some header field to the HTTP response will not stop execution of the current code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.