Password_verify() problem in PHP

Question

My intention is to call a page redirect if the password is not correct using header(), however, I realized that it was not working. I’ve been reducing the tests and I’ve come this far:

// Senha Certa
$senha = 'Teste123';
// Senha Errada
$senha = 'Teste1234';

// hash que combina com a senha 'Teste123'
$hash = '$2y$10$QW0qR0mI1oOB733baaleSe.aXwwAhJlpV6G5vOprKqP14HdcbECO.';

// Verificação da senha
if(!password_verify($senha, $hash)){
    header("Location: acesso-negado.php");
    //die("Usuário ou Senha Invádios");
}

header("Location: index.php");

Putting the wrong password, I realized that it ignores the header("Location: access-denied.php") and continues normally until it reaches the header("Location: index.php") and finally gets redirected.

I also noticed that if you put a die() under the header("Location: access-denied.php") it starts working correctly.

Does anyone know why redirecting only occurs with the use of die() below it? I am using php 7.2.7

Answer 1

Maybe it’s not very clear to you, but the function header does nothing but spit a string on the output, before the HTTP request body. Who handles the Location header and should do the redirect is the client.

So, if you want your entire response to be header Location, you need to close it yourself after you send that header, using exit, or the die as suggested in the other reply. Otherwise, your code keeps running normally, and ends up issuing a second header.

Answer 2

Your code is correct. The only thing is that to succeed, you need to finish it after the header("Location: acesso-negado.php");, otherwise it will continue until the next header normally and the other "Location":

// Senha Certa
$senha = 'Teste123';
// Senha Errada
$senha = 'Teste1234';

// hash que combina com a senha 'Teste123'
$hash = '$2y$10$QW0qR0mI1oOB733baaleSe.aXwwAhJlpV6G5vOprKqP14HdcbECO.';

// Verificação da senha
if(!password_verify($senha, $hash)){
    header("Location: acesso-negado.php");
    die; // <-- Finalizando aqui
}

header("Location: index.php");