1

I want to redirect users back to login page if they wrote the wrong password. I usually use header(location: "login.php?msg=wrong password"); when they type the wrong password or something.

  1. Does this method always work in modern browsers? what about the old ones? Is there a chance that a browser won't let the redirection happen? (If it only won't work in old browsers, then how old and which browsers?)

  2. Is this the best way to redirect users? In the example the mentioned example, how do professional web developers solve this issue of redirecting users and sending the GET variables to that URL?

Note that I use header to redirect users both to the same page and sometimes to another page, my main concern is sending the client to a page (another page or the same) with the get variables set, to show a message on that page.

EDIT: I had no idea I have to even state this, but based on answers I think I should: Yes, I am aware that PHP is back end and works in the server and not client! I am asking that do modern browsers meaning the clients browser support the redirection that is send by the server. Obviously when I said "redirect client" in the title, I didn't mean redirect the server.

  • Worth noting that... Browsers do not view or understand PHP. – Simon Hayter Nov 28 '18 at 13:09
  • @SimonHayter did i say they do? I'm asking that when the server sends a raw http to client asking it to redirect, do modern browser (clinets browser) always let it happen or stop it.. – John P Nov 28 '18 at 13:41
  • @JohnP I understand you understand that the redirection is coming from the back end. But again, the browser sees a redirection. Just that. And it follows it. We are not talking about front/back end and PHP shenanigans here, but the way that the HTTP works. The reason people insist on saying that php has nothing to do with it is because you keep on searching for an answer past the "the browser follows the redirect". When you ask "modern clients support the redirect from server" you ask the wrong question. It is not about browser versioning, but about how HTTP works. And it works as noted. – Σπύρος Γούλας Nov 28 '18 at 14:43
  • @JohnP you missed my point... your not telling people's browsers to redirect, your site is redirecting unconditionally without input from the person's browser, its not a matter of support, your page is simply blank until the new page is loaded, this is because the header is the first thing sent and everything stops there. These type of redirect is not to be confused with HTML/JS redirect which happens within the browser, so if you say this: yes i am aware that php is backend and works in the server and not client! why are you asking this question if you know the answer? – Simon Hayter Nov 28 '18 at 14:49
  • If your asking compatibility between PHP/HTACCESS/ASPX and so on, there's no difference between the 3, because the same method is used, how they got to that method, is irrelevant because that's server-side processing and therefore to the browser, it's exactly the same. – Simon Hayter Nov 28 '18 at 14:59
3

All major browsers support redirects and have done so seamlessly for 20 years.

The last browser that didn't support redirects well was Netscape 4. That was about 1997. Even then, redirects worked but:

  • The screen would flash.
  • The redirect URL was added to history. That meant that it was difficult to use the back button from the page after the redirect. Users would have to hit the back button twice really quick or they would end up just getting the redirect again.

Normally when you have questions about whether browsers support a feature you can can consult https://caniuse.com/. However, redirects have worked well for so long, that they don't feel that it is a browser feature even worth covering.

Redirecting to include parameters is fully supported as well. Your example redirect will work as you intend in all modern browsers.

Even though redirects work really well, they probably are not the correct solution to your particular problem. Ideally your login form would be produced by the same PHP file that checks the credentials. This would allow you to show the form again with the error message without doing any redirects. Typically redirects are use after successful login to take the user to whatever page they need to see next after logging in.

  • But if it was another page that i wanted to send these variables and send the client to, then using header is the best way right? (lets say for some reason the login page and checking the credentials is on different pages) – John P Nov 29 '18 at 5:57
  • ALSO one important note: even if its in the same page but i have a lot of different messages to show, using my method i can just use header and die, but if i had to not use this, then i have to write it in a way that reading the rest of the php wouldn't cause any problem, but why not just use header and die to simplify the code? what is the problem with using header in this situation, will i face problems? – John P Nov 29 '18 at 6:35
  • What you are proposing will mostly work. When using form handlers, it is usually best to keep the data the user has put into the form. Using your method, you will lose the user name. The user will have to type it in again, even if they only had the password wrong. You should also put the error message right next to the field that has the problem. Using a single error field won't let you do that. – Stephen Ostermiller Nov 29 '18 at 10:39
2

Your redirection takes place in the back end, via PHP. So it is not a matter of whether the modern browsers support it. This code runs on your (or your host's) server. It is not run in your browser, so no matter the browser edition no problems are gonna occur due to versioning.

To answer the second part of your question, in most sites there is no redirection in the case of a false password. There are some checks being run in the front/back end and then a message appears (in the same page) informing the user his/her credentials are wrong. Most of the time there is no good reason to create a whole new page just to show an error message (especially since users might want to retry, so they would have to go back to the login page, which is tiresome).

So, just make some informational message appear in the same page instead of redirecting.

Finally, using GET for sending/receiving credentials is a bad practice and I suggest using POST for any validation you want to run, especially for sensitive data like credentials.

edit

This has nothing to do with browser version but about how HTTP works.You can read more about it here but the basic premise is that

A browser, when receiving a redirect response, uses the new URL provided and immediately loads it

Browser doing that has nothing to do with its version. It is how HTTP works.

  • Yes i am aware of the fact that php is back end... thats why i asked do modern browsers meaning clients support it, i thought that was given. and of course it depends on the client, the web server will send a raw http asking the client to redirect, i was just wondering if there is any browser that stops the redirection.. – John P Nov 28 '18 at 13:44
  • @JohnP the client just sees a HTTP header for redirection. Nothing else. PHP and the way this header is generated has nothing to do with browser version. The browser will not stop the redirection. – Σπύρος Γούλας Nov 28 '18 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.