PHP possible header redirection exploit?

Question

I was thinking the other day, if someone is protecting their pages like this :

if(!$logged_in)
    {
        header("Location:http://mysite/login.php");
    }

    // protected content here

is there any way to ignore the HTTP Header redirect at the browser level and then display the protected content that follows it ?

Answer 1

Yes, because using the header() function merely sets a header. The server will continue running the rest of the PHP script, rendering the protected content

You'll want to do this instead

if(!$logged_in)
    {
        header("Location:http://mysite/login.php");
        exit();
    }