Pointing a User To A Certain Page After Login?

[akacj]

I am adding more things to my user login script. After the user logins in successfully, instead of going to their my account page by default , I want to check if they are required to perform some action.

Lets say they are required to change their password.

Ex. When they login , its going to go to a function that checks required actions. It will then check if a password change is required and then redirect them to the mandatory password change page.

I have been experimenting with some code, but having some troubles.

Here is the code I wrote:

Process.php

... ... ... ...
if ($returnval) {

[COLOR="#008000"]// LOGIN SUCCESS[/COLOR]

if ($functions->checkRequiredAction()) {
     [COLOR="#008000"]// action is required before anything else happens,[/COLOR] 

  }
  else {
       [COLOR="#008000"]// User is not required to do anything, go to the default account page[/COLOR]

  header("Location: " . $session->referrer);
  }

}

$functions = functions.php

Functions.php

function checkRequiredAction() { 

	[COLOR="#008000"]// Check If A User Password Change Is Required[/COLOR]
	if ($this->checkPwChangeReq($_SESSION['username'])) {
	  header("Location: " . $configs->getConfig('WEB_ROOT') . "pwchange.php");
	}	

}

I am not sure of how to code it correctly.

[NogDog]

One way to approach it is to not do HTTP redirects, but instead load the desired HTML page:

<?php
// do some initial processing, then...
if(!$loggedIn)
{
    require APP_BASE_DIR.'/view/login.php';
    exit;
}
elseif($changePasswordRequired)
{
    require APP_BASE_DIR.'/view/change_password.php';
    exit;
}
// either load the default page view here as above, or do
// a header() redirect if that makes more sense.

[sneakyimp]

If you are doing header redirects, there are two really important things to remember
1) You cannot send any headers if you have returned as much as one single character to the browser. Make sure you don't have echo statements or HTML output or even a single extra blank line in your scripts if you plan to send headers.
2) After you have sent a location header, you should exit immediately to prevent your script from outputting additional text/html.

[dalecosp]

sneakyimp;11045175 wrote:

If you are doing header redirects, there are two really important things to remember
1) You cannot send any headers if you have returned as much as one single character to the browser. Make sure you don't have echo statements or HTML output or even a single extra blank line in your scripts if you plan to send headers.

That's quite well-known and annotated, as I'm sure you're aware.

2) After you have sent a location header, you should exit immediately to prevent your script from outputting additional text/html.

I'm not sure how important this is, but I do it anyway. The same reason I put a default case in switches that have no other choices except those explicitly declared, I guess....

[Weedpacket]

dalecosp wrote:

I'm not sure how important this is, but I do it anyway. The same reason I put a default case in switches that have no other choices except those explicitly declared, I guess....

If you don't exit, processing does continue and any resulting output is sent (at least until PHP notices the browser has gone away (unless ignore_user_abort is turned on)). This is because a redirect is supposed to include things like a link to the intended destination page should the browser not redirect automatically and manual intervention is needed from the user.

[Bonesnap]

dalecosp;11045185 wrote:

That's quite well-known and annotated, as I'm sure you're aware.

You'd be surprised how many people do not know this, and the resulting error message mentioning headers already sent doesn't "translate" well to "You have output before the redirect" so it's not obvious to many who run into the issue.

[laserlight]

Weedpacket wrote:

This is because a redirect is supposed to include things like a link to the intended destination page should the browser not redirect automatically and manual intervention is needed from the user.

:o

That actually means that a simple exit, despite it being the example in the PHP manual, is not ideal: the exit should also output a link to the intended destination page, just in case.

[sneakyimp]

I merely point out these two things because they cost me a lot of time years ago before I became the grizzled PHP vet that I am now. I've seen a lot of convenience code written in various projects and frameworks in order to make sure that redirection happens properly. People send headers, make links, use META refresh, and I've also seen Javascript too.

[NogDog]

I've also gotten in the habit of doing a session_write_close() right before it, as it sometimes makes a difference (not sure if it's a server issue or PHP issue):

session_write_close();
header('Location: https://example.com/foo.php');
exit;

[Weedpacket]

That actually means that a simple exit, despite it being the example in the PHP manual, is not ideal: the exit should also output a link to the intended destination page, just in case.[/QUOTE]

RFC2616 said that the client MUST NOT automatically redirect without the user's confirmation - and how many browsers do that by default? - so having a page with a link would be necessary if the client UI provided no other affordance like a dialogue box; the RFC has been obsoleted by RFC7231, which replaces MUST NOT with MAY.

Just as an experiment, I'm going to turn off automatic redirects in my browser to see how annoying it gets 🙂

[Weedpacket]

sneakyimp;11045211 wrote:

I merely point out these two things because they cost me a lot of time years ago before I became the grizzled PHP vet that I am now. I've seen a lot of convenience code written in various projects and frameworks in order to make sure that redirection happens properly. People send headers, make links, use META refresh, and I've also seen Javascript too.

<html>
<head>
<script>
location.replace("http://www.example.com/new_page.html");
</script>
<noscript>
<meta http-equiv="Refresh" content="0; URL=http://www.example.com/new_page.html">
</noscript>
</head>
<body>
This page has moved to a <a href="http://www.example.com/new_page.html">new location</a>.
</body>
</html>