header redirect getting 200 page

[flycast]

I am using header in PHP to redirect if certain cookies are not present. When I issue the header command instead of the page I should be getting I get this page:

*****************************************
Page title: 200 OK

Page contents:
OK

The document has moved here.
*****************************************
The here is a link to the document that I redirected to. I need the document to display rather than a page that links to the document. Anybody have any ideas what is going on here and how I fix it?

 

[feherke]

Hi

To me it seems more a PHP related problem. But for now, give us more details. For example the PHP code you use, stripped to a relevant but still functional fragment.

By the way, is there any proxy in the way ? And what browser you use ?

Feherke.

http://rootshell.be/~feherke/

 

[flycast]

I have used header statements for redirects before with good results. The code:

if (!isset($_COOKIE['State']) and !isset($_SESSION['State'])){
ini_set('session.use_trans_sid', true);
$_SESSION['Page'] = $_SERVER['SCRIPT_NAME'];
setcookie("Page", $_SERVER['SCRIPT_NAME'], time() + (60*60));
//header("Location: entry?PHPSESSID=".session_id());
header("Location:

http://www.cnn.com");

}elseif (isset($_COOKIE['State'])){
ini_set('session.use_trans_sid', false);
$State = $_COOKIE['State'];
setcookie("State", $State, time() + (60*60*24*365*2));
}

I have tried the above code with an exit() after the redirect with no difference. The code is at the end of the function so nothing executes after the last line.

There is not a proxy in the way.
Firefox browser, it does the same thing in IE6.

 

[feherke]

Hi

The code is at the end of the function so nothing executes after the last line.

And what is before that code ? Are you sure nothing else outputs some content before that [tt]header()[/tt] call ? That fragment alone works for me.

Feherke.

http://rootshell.be/~feherke/

 

[flycast]

Here is the entire code:

function cookieCheck(){

//Check for robots and allow them to see the site
if (preg_match ( "/Google/", $_SERVER['HTTP_USER_AGENT'])){
//It's a robot
exit();
}

//Check for cookies first
if (!isset($_COOKIE['State']) and !isset($_SESSION['State'])){
ini_set('session.use_trans_sid', true);
$_SESSION['Page'] = $_SERVER['SCRIPT_NAME'];
setcookie("Page", $_SERVER['SCRIPT_NAME'], time() + (60*60));
//header("Location: entry?PHPSESSID=".session_id());
header("Location:

http://www.cnn.com");

}elseif (isset($_COOKIE['State'])){
ini_set('session.use_trans_sid', false);
$State = $_COOKIE['State'];
setcookie("State", $State, time() + (60*60*24*365*2));
}
/*
echo "Session id: ".session_id()."<br>";
echo "Session State: ".$_SESSION['State']."<br>";
echo "Session Page: ".$_SESSION['Page']."<br>";
echo "Cookie state: ".$_COOKIE['State']."<br>";
echo "Cookie state: ".$_COOKIE['Page']."<br>";
*/
}//End of cookieCheck function]

That is the point - it works for me too! I don;t understand why I am getting the Apache page.

 

[feherke]

Hi

I think I was not clear enough. I did not asked what before the [tt]header()[/tt] call in that function, but overall. So on this case, before calling the cookieCheck() function.

//Check for robots and allow them to see the site
if (preg_match ( "/Google/", $_SERVER['HTTP_USER_AGENT'])){
    //It's a robot
    exit();
}

Hmm... Interesting wording... "allow them to see the site"... You mean that the cookie checking is part of a security mechanism ? I hope it is not, otherwise :
[ul]
[li]anyone who will set his browser name to something including Google, will be able to see the site[/li]
[li]anyone will be able to see the site in the Google Cache[/li]
[/ul]

That is the point - it works for me too! I don;t understand why I am getting the Apache page.

Sorry, but I am confused now. I thought the two things exclude each other : either works or displays that page.

Feherke.

http://rootshell.be/~feherke/

 

[flycast]

Quote (flycast):
That is the point - it works for me too! I don;t understand why I am getting the Apache page.

Sorry, but I am confused now. I thought the two things exclude each other : either works or displays that page.

I am getting an Apache generated page that points to the actual page. I am not getting the actual page that I redirected to. On the Apache page I get a link that you have to click to go to the actual page that I redirected to.

This is not part of any tight security thing. It is a site that sells financial/retirement instruments. They have to make users aware that they can only do business in certain states. I want to allow robots to browse so the site gets listed. All we need to do with users is do a reasonable job letting them know if they are in the correct state.

 

[feherke]

Hi

Aham. I understand. So it not works.

Please post the HTTP headers transfered when requesting such page. You can see them in [tt]telnet[/tt] or [tt]netcat[/tt] or use a browser extension :
[ul]
[li]FireFox - Live HTTP Headers[/li]
[li]Explorer - ieHTTPheaders[/li]
[/ul]

Feherke.

http://rootshell.be/~feherke/