Question

I am currently using the Tonic PHP framework to build a RESTful application ( http://peej.github.com/tonic/ ) and am having an issue that I cannot figure out how to get around with redirecting a user after having someone log out. The strange part is that logging in works just fine.

My basic code works list this: when a user goes to log in, they fill out a simple form a press a submit button to do a post request to the same page the form is on. ( website.com/login ) The post handling code looks like this:

public function post( $request )
{
    if( isset( $_POST[ 'username' ] ) && $_POST[ 'username' ] === 'username' &&
            isset( $_POST[ 'password' ] ) && $_POST[ 'password' ] === 'password' )
        {
            $_SESSION[ 'loggedin' ] = true;
            $response = new Response( $request );
            $response->addHeader( 'Location', '/' );
            return $response;
        }
        else
        {
            $response = new Response( $request );
            $response->addHeader( 'Location', '/login/fail' );
            return $response;
        }
}

(the current code is just a temporary thing so I can test functionality) This will properly set the session variable and redirect back to my index page, with my PHP code outputting all the proper menus and things for being logged in.

The problem I then have, is with the button directly inside the menu bar on my web page for logging out. I tried two methods for this with neither working: a simple anchor tag with an href to the page webspace.com/logout, and putting a form with just a restyled submit button in the menu to look like a normal link, using post as the method to the same page. Both of them have this code:

public function post( $request )
{
    $response = new Response( $request );
    $response->code = Response::MOVEDPERMANENTLY;
    $response->addHeader( 'Location', '/' );
    $response->body = "<b>Succesfully logged out!</b>";
    $_SESSION[ 'loggedin' ] = false;
    return $response;
}

(or at least variations on that, trying various things) When this code is used from the menu bar, either through an anchor tag or a form submit button, it will go to the /logout page and just stay there, outputting any body text if it exists. The PHP code checking if the user is not “logged in” doesn’t even trigger, leaving the menu bar in a state of looking like you are currently logged in, even though the moment you go to another page it changes to the logged out code, meaning you have successfully logged out already. I’ve tried various things, and just going there through the browser bar directly will work fine, and not setting the session variable will also cause it to work fine. (as far as I’ve seen) I have no idea what is going on. Thank you for any help in advance.

Answer 1

Never mind, I realized the problem (which was just me being stupid): I was doing output to the page BEFORE issuing a Location header, causing it to be ignored by the browser. Shuffling order of operations around a bit on my main page fixed the problem.

Let this be a warning to all: make sure you issue headers before echoing any code out to the browser, no matter what. In my case, this required me to do all the handling code for the current URI before my HTML code, then sending the output from the request to the browser in the correct location.