Various PHP questions - php

Question

about this function:
function requireSSL() {
if($_SERVER['SERVER_PORT'] != 443) {
header("HTTP/1.1 301 Moved Permanently");
header("Location: https://" . $_SERVER['HTTP_HOST'] .$_SERVER['REQUEST_URI']);
exit;
}
return false;
}
SSL requires port 443, so in this piece of code if not 443 then forced to use https? and if 443 it would automatically use https I assumed. What's the moved permanently used for?
The code header("Location: .");
What's use of the above, it's nothing more than telling it to stay at the same page. By default it should stay at the same page, isn't it redundant?

Answer 1

SSL requires port 443
Not always. That is the default port. HTTPS can be configured to run on other ports. A better way to check is:
if ( !isset($_SERVER['HTTPS']) || strtolower($_SERVER['HTTPS']) != 'on') {
}
What's the moved permanently used for?
From w3:
The requested resource has been assigned a new permanent URI and any
future references to this resource SHOULD use one of the returned
URIs
In other words, a browser should remember that the requested URI is moved and request the new URI anytime the user requests that old URI again.
By default it should stay at the same page, isn't it redundant?
That's not what the code is doing. It's redirecting to the https version when the user requests the non-https version.

Answer 2

This piece of code is redirecting the client to use https in case it does not use https. 301 tells the client to always use the new location.
The redirection is done via the Location header, and you are only partly right, the page is the same, but the connection is done via https and not http. If the client is already connected via https, the redirect does not occur.

Answer 3

1) HTTP/1.1 301 is for letting the browser and search engines know that the page has moved to https://example.com/thepage.php
2) This code is used for specific pages or sites that require SSL. Example: Shopping carts, banks, logins

Answer 4

HTTPS goes through port 443 by default. This code redirects the user, using the Location-header, to the HTTPS if the user is visiting through plain HTTP.
The 301 instructs the browser to always redirecting HTTP to HTTPS on succeeding requests on that URL.
In psuedo-code it does this:
if (user is NOT visiting through HTTPS)
redirect permanently to the same URL, but then through HTTPS
So no, it's not redundant, for if anyone visits that page using HTTPS, the body of the if-block will not be executed and no redirect takes place.

Answer 5

First of all, the function does what you think.
Let's go through each of those you want to learn more about:
header("HTTP/1.1 301 Moved Permanently");
This sets the HTTP response status code. Code: 301. Message: Moved Permanently. 301 is a permanent redirect, this just tells the browser (HTTP client), next time to use the new address directly instead of the requested one.
The new address is given with a Location: header.
header("Location: .");
This code is just plain wrong code. Don't expect that it works. I assume somebody wanted to redirect to the same page again, but this does not work this way. A Location: needs to be followed by an absolute URL, this is a relative URL and won't work. Absolute URLs always start with http:// or https:// and contain a host-name.