Hi WDF.

 

I'm working on a site which has a user login. The login process used to be handled in one page and on successful login would go to a user area. I've added a new quick login on each page and set it to send to the login page which would then forward to the user area if successful. The problem is that with the process 'Any Page > Login > User Area' it triggers my internet security program saying;

 

The requested URL cannot be provided
URL: (website url)

Blocked by Web Anti-Virus
Reason: phishing URL

Detection method: heuristic analysis

 

But this only triggers with the 'Any Page (Submit to Login Page) > Login Page (checks true / false) > User Area (success)' and the original 'Login (submit self & true / false) > User Area (success)' works fine without this problem.

 

Does anyone know the cause of this sort of thing? Would I need to change it to 'Any Page (submit self & true / false) > User Area (success) or > Login Page (false)' to get round this?

 

Thanks

Does the domain change during the steps in the first scenario? Or is data passed insecurely through any of the steps?

 

It sounds like your internet security software is a bit paranoid!

No the domain stays the same, for testing sake i'm not even running it over https as the switch is what I thought was causing it; must just be a paranoid security

Aha fixed! The header location must have an exit(); else the internet security software thinks you will continue running a script after the page redirects. This however would appear to only be required to appease the internet security as it 'technically' works without.

 

<?php
header('Location: http://www.somewhere.com/');
exit();
?>

Annoying little quirk! Glad you've solved that one

Yeah annoying as hell ... it's the little things that take the longest to resolve

Yeah annoying as hell ... it's the little things that take the longest to resolve

 

As best practice it is always good to add an exit(); after your redirect regardless if the internet security thing pops up or not. This is due to the fact say you have a profile page just for logged in users. But your redirect ends up failing for some unknown reason. If you do not exit the script the profile page can still be viewed by non logged in users.

Noted WD93 as to 'best practice', still loads to learn for me but login aside this is any header as I since tested with 301 etc and without the exit(); the same security trigger will occur. Sure it's 1 internet security but the one I was using is Kaspersky with over '300 million users worldwide'. I wonder if more security companies will be implementing it at a later date

Although it's a best practice to place exit() anywhere you think something may continue when it shouldn't, in 10 years programming PHP I've never come across this.

 

Are you developing locally? Or testing via a remote server?
If it's on a remote server I've no idea how any security software could know whether you've placed exit() at the end of your scripts.

 

If it's local, well then I'd switch it off - sounds like it's being daft!!

Someone's gotta make the frameworks