标头重定向的安全性如何？可以绕过吗？
标头重定向的安全性如何？据我了解，标头信息指示浏览器做什么。那么，如果将header位置设置到其他地方，是否还能让浏览器登陆到初始页面呢？
if(!$loggedin){
header('Location: someotherpage.php')
}
如果有人（咳咳）忘记在标题后使用退出命令，那么有人仍然可以登陆该页面吗？
How secure are header redirects? As I understand it, the header information instructs the browser what to do. Therefore, if the header location is set to some other place, can the browser still be made to land on the initial page?
if(!$loggedin){
header('Location: someotherpage.php')
}
If someone, (cough cough) forgot to use an exit command after the header, could someone still land on that page?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
当然 - 忘记
exit()意味着客户端仍然可以看到发出的任何数据，而不是登陆该页面（他已经拥有了）在这些行之后。没有人可以在收到Location:标头后强迫客户端立即离开。该行动完全是自愿的。Sure - rather than land on that page (which he already has), forgetting an
exit()means the client can still see any data emitted after those lines. Nobody can force the client to leave immediately after receiving aLocation:header. That action is entirely voluntary.是的，绝对是。这就是为什么在您想避免显示非法信息的情况下，重定向后应该跟随 else（或退出）。如果使用自定义请求，他们可以轻松查看重定向请求后的内容，这是一个非常标准的安全问题。
Yes, definitely. That is why an else should follow(or an exit) after a redirect in the case that you want to avoid showing illegitimate information. If one uses a custom request, they can easily view what follows after a redirect request, it's a pretty standard security issue.
是的。仍然有可能登陆该页面，您不能强制“位置”。如果页面抛出“标头已发送”错误，也可能“意外”加载页面的其余部分。
发送
header('Location...')后使用exit;是一种很好的做法。请参阅 PHP 函数： headers_sent
Yes. It would be possible to still land on that page, you cannot force 'Location'. It's also possible to "accidentally" load the rest of the page if the page throws "headers already sent" errors.
It is good practice to use
exit;after sending aheader('Location...').See PHP function: headers_sent