Question

So far, my HTTP_REFERER redirect script looks something like this on a page where the user can’t access (submit.php) until they login:

session_start();
 if(!isset($_SESSION['user_id'])) {
 header("Location: login.php");
 exit();
}

Which is fine, because, obviously if they try to go to submit.php, they need to login first. But once they login, they are taken to login.php again, since login.php was the last page they visited, instead of submit.php (which should be the correct page they are trying to get to).

This is only a problem for pages that aren’t shown until the user logs in. For example, if they go to /contact.php and then login, it will taken them right back to contact.php, but that is because it can be seen when they are logged out as well

Answer 1

I try not to use HTTP_REFERER gives me allot of headache most of the time.

I would suggest saving the url to the session where they enter your application, so just before you redirect and check if they are authenticated. Then they will hit the login and forward them to the page saved in your session. Make sure you don’t save the login page if so redirect to the homepage or some other page.