Home/ Questions/Q 7600583
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-30T22:56:42+00:00

I am doing a login page for my application. When a user wants to

  • 0

I am doing a login page for my application. When a user wants to go to “myaccount.php” but he’s not logged in, he’s redirected to login.php.

When login is successful, I want him to be redirected to $_SERVER['HTTP_REFERER'], which will be various pages of my application.

I read on forum that ['HTTP_REFERER'] can be dangerous.

But what if I create an array like (‘myaccount.php’,’mycart.php’, etc…) and compare this array to $_SERVER['HTTP_REFERER'], will this protect me against potential malicious use of this feature?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    $_SERVER[“HTTP_REFERER”] is not dangerous – it’s just attacker controlled. It won’t hurt you unless you trust it for granting extra permissions to someone (e.g. don’t assume that someone who just came from successful-login.php has successfully logged in!)

    Redirecting a user doesn’t grant any special permissions to the user, so redirecting an attacker to an attacker-controlled string does not compromise your server’s security in any way.

    • 0