Protecting a webpage without headings

Question

I just read an article on tdwtf.com . Typically, he describes an archiver that destroys things because it ignores headers. Then I realized that I did not know how to make security on a page WITHOUT headings. So my question is:

What security measures can I use besides using headers?

I mainly develop in php, so I am familiar with the header ("Location:") function. But what else is there?

Ideally, I want to replace the logic

if (!$something_important) header("Location: somehereharmless.php");

with something else (more) safe?

Answer 1

header: , . - .

- :

<?php
function redirect($url)
{
    header('Location: ' . $url);
    exit('<a href="' . $url . '">Redirecting you to: ' . $url . '</a>');
}

redirect('somepage.php');
?>

, , .

---

[]

, POST . GET (, <img src="http://www.example.org/action.php?do=SetAsAdmin&userid=MyUserId" />).

Answer 2

if (!$something_important) {
  header("Location: somehereharmless.php");
  exit();
}

, , , ,

Answer 3

,

Idempotent , , .

Answer 4

, PHP script, , , , , , script, , . , :

if (user_is_authorized()) {
    // restricted code here
}

if (!user_is_authorized()) {
    // send headers or whatever if you want
    exit();
}
// restricted code here

, ... , , ... - , - , HTTP. - , , . , ( , ). , () HTTP- . ( , HTTP-, ), , , , .)

Answer 5

, , exit; header();. , script .

Answer 6

if (!$something_important) {
  header("Location: somehereharmless.php");
  //close all your db connections and other stuff you need to end..parhaps calling a function?
  die("If the redirect doesnt start in 3 seconds, please <a href=\"somehereharmless.php\">click here</a>");
}

Answer 7

<?php
die($errormessage);

Die script, , , .

Answer 8

. ( "" ), . .

if($foo && $bar)
{
    header("Location: somehereharmless.php");
}

if($foo && $baz)
{
    header("Location: someotherplace.php");
}

, 3 , someotherplace.php. (); (); ();