delay or prevent loading until php script / javascript has fully executed

Question

I have an Auth script at top of my php/html pages on my website to redirect people when they try to access protected content without being logged in. The issue I am having is that content in the protected area link is unintentionally loaded and in a flash information can be seen before the window.location.href redirects user to the default login page. This creates a security vulnerability where protected info can be seen for a fraction of a second on whatever page they are trying to access from the outside.

Is there a way to make it so the protected content doesn't load until after the auth script is thoroughly executed?

The script below is at the top of all my protected pages:

require_once('userSessionAuth.php')

In ^the above script^ I have a:

 alert("You are not logged in!");
 window.location.href="http://example.com/customerlogin.php";

^^All the protected content is listed after these two lines on all my protected pages.

So really, one could just disable javascript, and see all your protected content then? The proper thing to do, is to only output the content from the server, if the user is authorized — adeneo
– adeneo, Commented Jan 22, 2016 at 17:58

Madbreaks · Accepted Answer · 2016-01-22 18:00:40Z

3

Do the redirect on the server side instead of returning any content to the client:

<?php
// check for auth, if not authenticated then:
header('Location: "http://example.com/customerlogin.php');
exit;
?>

Docs here: http://php.net/manual/en/function.header.php

edited Jan 22, 2016 at 18:00

answered Jan 22, 2016 at 17:59

Madbreaks

19.6k7 gold badges62 silver badges75 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Madbreaks Over a year ago

@superiorpancakes really :)

Meroje · Accepted Answer · 2016-01-22 17:59:57Z

0

Your actual problem is the protected content is sent anyway.

Use the header function to send a Location redirect and exit your script right after.

answered Jan 22, 2016 at 17:59

Meroje

3442 silver badges6 bronze badges

Collectives™ on Stack Overflow

delay or prevent loading until php script / javascript has fully executed

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related