what kind of PHP will cause a 302 code in the server log?

sneakyimp

i'm working on a site that hasn't been launched yet. even though the site hasn't been launched, i see some 411 distinct IP addresses that have accessed my site.

i've also seen apache codes that seem puzzling to me.

for instance, code 302 supposedly means the page has been temporarily moved...at least according to this page:
http://www.jcornelius.com/articles/archives/20040417/apache-server-response-codes/

and yet here's a hack involving that same code.
http://clsc.net/research/google-302-page-hijack.htm

what sort of PHP code will cause the server to log a 302 code? is it something as simple as header()? i'm relieved to note that nearly every access with this 302 code is from my own computer, but there is one other computer which has also received this code.

mtmosier

As far as php goes, the only code I know off the top of my head which causes a 302 is

header('Location: ...');

Apache can also do 302s, via url rewriting for example.

sneakyimp

ok...that sounds reasonable. the page that says it stands for 'temporarily moved' isn't fully accurate.

i still don't understand that 302 exploit. will have to read that again.

mtmosier

Ya know, I was about to give my summary of the 302 google page hijack. Then I realized that if someone wanted to perform this hijack using php but didn't know how, the logical question to ask would be "what php code would cause the server to return a 302 code." Doh! I think I should shut up now, just to be on the safe side. 🙂

Weedpacket

Originally posted by sneakyimp
ok...that sounds reasonable. the page that says it stands for 'temporarily moved' isn't fully accurate.

i still don't understand that 302 exploit. will have to read that again.

Basically, the attacker redirects Googlebot to the site the attacker is stealing the ranking of, while everyone else gets the attacker's site.

Incidentally, the official description of HTTP response codes such as 302 Found and so forth is RFC2616 (Chapter 10). Strictly speaking a 303 See Other response should be used instead, but as the RFC notes this was new in HTTP/1.1 and 1.0-only agents won't know what to do with it.

Kudose

I had always been under the impression that a 302 counted against you, but a 301 was okay.

Guess I was wrong.

sneakyimp

the reason i asked was that i was looking through the apache log for my as-yet-unlaunched site and found a bunch of 302 codes. i am using some header('location...') stuff in there and was just wondering if using that results in 302s in my log.

i'm guessing (still) that the answer is yes.

EDIT: I verified that header() does in fact create 302 entries. I'm wondering if anything else can??

thanks weedpacket for the official link. will read that. all 100 pages or so eventually.

ultimately, i'm using the header('location...') stuff for some multi-page forms. users are taking a test....when they click 'submit' on a given page, it submits to itself of data validation. if the data looks good, i use header() to redirect to the next page of the test.

when the last page is completed, i use header() to prevent the user from hitting 'refresh' and double-submitting the test and cluttering up my database and ruining everything.

ultimately, i would not want these test pages to show up in any kind of search engine. i'm guessing that they generally won't because i'm using the header() redirects to get to them rather than any kind of specific link, so search response to these particular codes is pretty much irrelevant. a search engine should never be able to complete one of the tests because you have to be logged in to do so.