Why I have to call 'exit' after redirection through header('Location..') in PHP?

Question

You know that if you want to redirect an user in PHP you can use the header function:

header('Location: http://smowhere.com');

It is also well known that it is a good practice to put also an exit; after the header call, to prevent execution of other php code. So my question is: could the code after the header-location call be effectively executed? In which cases? Can a malicious user be able to completely ignore the header('Location..') call? How?

Solution 1

could the code after the header-location call be effectively executed?

Yes, always. The header is only a line of data asking the browser to redirect. The rest of the page will still be served by PHP and can be looked at by the client by simply preventing the header command from executing.

That is easy enough to do with a command-line client like wget, for example, by simply telling it not to follow redirects.

Bottom line: If you don't prevent it, PHP will send out the whole body even after a header call. That body is fully available to the recipient without any special hacking skills.

Solution 2

If you redirect but you don't die() / exit() the code is always executed and displayed.

Take the following example:

admin.php:

if (authenticationFails)
{
    // redirect and don't die
}

// show admin stuff

If you don't make sure to end the execution after the location header every user will gain access.

Solution 3

header() instructs PHP that a HTTP header should be sent... When the HTTP headers are sent.

And those are not sent immediatly when you write the call to header(), but when it's time to send them (typically, when PHP needs to begin sending the body of the response -- which might be later than you think, when output_buffering is enabed).

So, if you just call header(), there is absolutly ne guarantee that the code written after this statement is not executed -- unless you indicate that it must not, by using exit/die.

The user can ignore the Location header if he wants ; but it will not change anything on the fact that the code after the call of header() might or might not be executed : that matter is server-side.

Solution 4

Without the exit call, the exact point/time at which your script will terminate will come down to two factors:

1. How quickly the client browser reacts to the redirect
2. How much time it takes the rest of your script to execute.

Let's say the browser IMMEDIATELY starts the redirect action the moment it sees the Location header come through. That means it will shut down the connection from which the redirect comes, so it can start connecting to the new location. This generally means the web server will terminate the redirecting script. However long it takes for the header to go from server->client and the TCP link shutdown process to go from client->server is the amount of time in which your script can keep running.

Solution 5

re: could the code after the header-location call be effectively executed?

Yes if you don't close the script.

re: In which cases?

In every case.

Can a malicious user be able to completely ignore the header('Location..') call?

No, it will get exacted the user has no say in the matter.

View more solutions