How do I redirect the user to the address they are visiting after logging in?

Question

How do I redirect the user to the page they were browsing after the user logged in? I’ve seen solutions using $_SERVER['HTTP_REFERER'];, but I think it’s not a good idea, could help me with some example of code ?

Grateful

Answer 1

Implement URL storage in your process. Example:

• While the user browses through public states without needing Sign-in, intercept the current URL and store it in session or local Storage.
• User navigates to a state that requires login. Redirect/treat.
• When the user returns, get the URL you previously stored and redirect to the corresponding state.

Answer 2

With the $_SERVER['HTTP_REFERER'], you will get the referrer which was defined by the sent header, this is unreliable, but may reasonably believe in it for that purpose. You can also use a parameter in the URL to indicate which page is next.

---

One method used in both cases is to use the ?pagina=, for example Twitter, Instagram, Facebook:

twitter.com/login?redirect_after_login=%2FInkeliz

instagram.com/accounts/login/?next=%2FInkeliz

facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2FInkeliz

This indicates that after login it will go where the parameter indicates.

---

That way you can have a buttock, <div class="fazerLogin">LOGIN</div> and use it to always add the parameter, for example:

$('.fazerLogin').attr('href',
  'https://exemplo.com/login?next=' + encodeURIComponent($(location).attr('href'))
);

<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>

<a class="fazerLogin" href="https://exemplo.com/login">LOGIN</a>    

Place your mouse to "LOGIN" to see the new URL path.

So in PHP do the following:

1. Get the parameter next.

2. Check the next is valid, matches your domain.

3. Redirect the user.

---

For example:

// Define um URL padrão se não houver um válido
function linkEncaminhar($nomeParametro){

    $url = 'https://exemplo.com/perfil';

     if(isLinkValido($nomeParametro) === true){
        $url = urldecode($_GET[$nomeParametro]);
     }

    return $url;

}

// Verifica se o URL é válido
function isLinkValido($nomeParametro){

    $meuDominio = 'https://exemplo.com/';

    return isset($_GET[$nomeParametro]) &&
           is_string($_GET[$nomeParametro]) &&
           substr( urldecode($_GET[$nomeParametro]) , 0, strlen($meuDominio)) === $meuDominio;

}

Thus:

$urlRedicionar = linkEncaminhar('next');

header('Location: ' . $urlRedicionar);

That way if the https://exemplo.com/login?next=https%3A%2F%2Fexemplo.com%2Fsobre-nos is accessed after the login will go to https://exemplo.com/sobre-nos.

---

/!\ CARING:

If there is a link of type https://exemplo.com/configuracao?excluir_conta=true without any kind of CSRF-Token, a person can make a https://exemplo.com/login?next=https://exemplo.com/configuracao?excluir_conta=true, then after the person connects and will be redirected to such URL, which will delete the account, in this hypothetical situation!

_{There is such a problem on a state site "very famous"...}

Answer 3

Can use header('location:pagina.ext');