如果未使用 php 会话登录，则进行用户重定向

Question

I am beginner in web development and i am creating my first project. I am using XAMPP, for my php files. I have basically created app.php , sigin.php . So in order to prevent user from directly access my app.php i am using session variables in php. Hence i added the following PHP code just before my app.php .

<?php
    session_start();

    if(!isset($_SESSION['loginstatus'])) {
        header('location:./login.php');
        die();
    }
?>

And i am setting my session variables in my signin.php like the following:

if($user['username'] == $username && $user['password'] == $password) {
        $_SESSION['username'] = $username;
        $_SESSION['loginstatus'] = 'success';

        echo "success!";

        header('location:../app.php');
 }

Now i tried accessing my app.php without login, i am still able to access app.php . To check where is the issue i cleared my browser history and cookies, then i tried accessing app.php , then surprisingly it worked i was actually redirected to login page, but as soon as i do first succesfull login, and logout and again try to access app.php without login, i was again able to access app.php without login.

Now for some reason i feel that my browser is saving session variables too, So to check that i wrote a small piece of code and pasted in my app.php :

<?php
    var_dump($_SESSION['loginstatus']);
?>

after first successful login my $_SESSION['loginstatus'] is always set to successful . Now as i said i am a beginner, what i learnt is session are stored in server side. So i am totally confused regarding this.

Answer 1

There is a cookie in your webbrowser "phpsessid" wich stores the id of the Session on the server. In normal cases you destroy the Session, at logout.

session_unset(); to unset all session variables

session_destroy(); destroys the session

The Session will timeout after time X. You can change it, described here -> Link

So if you have a cookie in your Browser with a valid id of a not-timeouted Session you will always be able to log in.

Answer 2

So basically, going to browser setting > privacy and security > more > pre-load pages for faster browsing and searching

I just disabled this default setting from chrome, and it started working as expected.