如何保护我的网站内容不被cURL访问？

Question

我有一个网站,要求用户在访问内容之前登录.在每个受保护的页面上,我使用此代码,从浏览器访问时可以正常工作:

// check if they are logged in
if (!isset($_SESSION['valid_user'])) {
    header('Location: ./login.php');
}

// functions to display the page
display_page();

问题是如果我使用cURL访问页面,则不会发生重定向并返回内容.这让我很担心......我该怎么办？

我尝试添加else if(isset($ _ SESSION ['valid_user'])){//显示页面},但这不起作用.

Answer 1

在当前状态下,您发送标题以将用户重定向到登录页面,但您仍然提供页面内容.就这样停止这样做:

// check if they are logged in
if (!isset($_SESSION['valid_user'])) {
    header('Location: ./login.php');
    // and get out of here if they aren't
    exit();
}
// OK, they're logged in, let them see some content
// functions to display the page
display_page();

要么

// check if they are logged in
if (!isset($_SESSION['valid_user'])) {
    header('Location: ./login.php');
    // and get out of here if they aren't
} else {
   // OK, they're logged in, let them see some content
   // functions to display the page
   display_page();
}