So I have a login script that assigns a session to the user once he logs in. This script normally redirects to the index if the session DOES NOT exist, else it continues to another php script called login_successful.php
I added the session script to the HeaderName because I have a file directory that needs to be protected from people who are NOT logged in and I want to prevent direct URL access to the files in uploads directory. I don't want to list the directory using PHP for sheer simplicity. Here is my .htaccess:
Options +Indexes
IndexOptions FancyIndexing
AddType text/html .php
Addhandler application/x-httpd-php .php
HeaderName /header.php
Here is my header.php for Apache HeaderName:
<?php
session_start();
// IF USER NOT REMEMBERED(DID NOT CLICK REMEBER ME BUTTON) OR NO SESSION IS FOUND THEN THROW HIM OUT TO LOGIN
//SECURITY SO THAT USERS CANT ACCESS WEB URL DIRECTLY
if (!isset($_SESSION['myusername']) && !isset($_COOKIE['myusername']))
{
header("Location: index.php");
}
?>
The HeaderName directive works if I use regular php expressions like echo
but does not work with the code above.
what am I doing wrong?
Help is appreciated
<html><body>...
type stuff BEFORE it reaches the file you're including via headername, which means thatheader()
calls are not permitted anymore.