56

You know that if you want to redirect a user in PHP you can use the header function:

header('Location: http://smowhere.com');

It is also well known that it is a good practice to put also an exit; after the header call, to prevent execution of other php code. So my question is: could the code after the header-location call be effectively executed? In which cases? Can a malicious user be able to completely ignore the header('Location..') call? How?

starball
  • 20,030
  • 7
  • 43
  • 238
Nicolò Martini
  • 5,182
  • 4
  • 32
  • 38

6 Answers6

59

could the code after the header-location call be effectively executed?

Yes, always. The header is only a line of data asking the browser to redirect. The rest of the page will still be served by PHP and can be looked at by the client by simply preventing the header command from executing.

That is easy enough to do with a command-line client like wget, for example, by simply telling it not to follow redirects.

Bottom line: If you don't prevent it, PHP will send out the whole body even after a header call. That body is fully available to the recipient without any special hacking skills.

Pekka
  • 442,112
  • 142
  • 972
  • 1,088
  • Best way to test and see this in action is do to header redirects, and then notice that if you comment out the die, it goes to the second, with it there, it only executes the first. But with this you could execute CURL or several other commands after the redirect. Which is great in many situations to have. LIVE EXAMPLE: https://codenvy.com/factory?id=fkugtmevk9qfl24d – Ezos Feb 11 '14 at 21:24
26

If you redirect but you don't die() / exit() the code is always executed and displayed.

Take the following example:

admin.php:

if (authenticationFails)
{
    // redirect and don't die
}

// show admin stuff

If you don't make sure to end the execution after the location header every user will gain access.

Alix Axel
  • 151,645
  • 95
  • 393
  • 500
9

header() instructs PHP that a HTTP header should be sent... When the HTTP headers are sent.

And those are not sent immediatly when you write the call to header(), but when it's time to send them (typically, when PHP needs to begin sending the body of the response -- which might be later than you think, when output_buffering is enabed).

So, if you just call header(), there is absolutly ne guarantee that the code written after this statement is not executed -- unless you indicate that it must not, by using exit/die.

The user can ignore the Location header if he wants ; but it will not change anything on the fact that the code after the call of header() might or might not be executed : that matter is server-side.

Pascal MARTIN
  • 395,085
  • 80
  • 655
  • 663
1

PHP Code after a header() will be run. Sometimes, that is required though, as the example on php.net shows. To make sure it's not, you end the program flow entirely.

Alister Bulman
  • 34,482
  • 9
  • 71
  • 110
1

Without the exit call, the exact point/time at which your script will terminate will come down to two factors:

  1. How quickly the client browser reacts to the redirect
  2. How much time it takes the rest of your script to execute.

Let's say the browser IMMEDIATELY starts the redirect action the moment it sees the Location header come through. That means it will shut down the connection from which the redirect comes, so it can start connecting to the new location. This generally means the web server will terminate the redirecting script. However long it takes for the header to go from server->client and the TCP link shutdown process to go from client->server is the amount of time in which your script can keep running.

Marc B
  • 356,200
  • 43
  • 426
  • 500
  • Please see http://stackoverflow.com/questions/14847010/will-php-script-be-executed-after-header-redirect for other answers – user1032531 Feb 13 '13 at 05:59
  • There is an important third factor here which makes this answer slightly misleading: when PHP actually sends the header. The call to `header` doesn't actually immediately echo an HTTP header to the network stream, it just adds it to an array of headers which *will* be sent when the response starts being sent. If the output is buffered, or you don't echo anything until much later in the script, there isn't even a possibility of the browser reacting to the redirect early. – IMSoP Jul 14 '22 at 11:06
  • The other unhelpful thing about this way of thinking is that you can't *trust* the browser to redirect immediately. It might actually be a malicious user sending requests manually to see what happens. So while you can't necessarily assume that code after the header call will *always* be run, you have to assume that it *sometimes* will be. – IMSoP Jul 14 '22 at 11:08
0

re: could the code after the header-location call be effectively executed?

Yes if you don't close the script.

re: In which cases?

In every case.

Can a malicious user be able to completely ignore the header('Location..') call?

No, it will get exacted the user has no say in the matter.

Steven Smethurst
  • 4,495
  • 15
  • 55
  • 92
  • No it doesn't, @CarsonMyers, the PHP code after it will always be executed. – kuilin Feb 08 '15 at 02:55
  • A malicious user can interpret the response however they like. They can look at the Location header and say "that's nice, but what else have you sent me". If you don't want them to look at certain data, you have to make sure you never send it to them; you can't just put a label on it saying "please don't read this". – IMSoP Jul 14 '22 at 10:58