Are there potential pitfalls in using header("Location: $path") to redirect to a download URL in PHP?

Using header("Location: $path") to redirect to a download URL in PHP can potentially expose the download URL and make it vulnerable to attacks like URL manipulation. To prevent this, you can use a combination of PHP headers and readfile() function to securely serve the file for download without exposing the actual download URL. 

<?php
// Set the file path
$file = 'path/to/download/file.pdf';

// Check if the file exists
if (file_exists($file)) {
    // Set the appropriate headers
    header('Content-Description: File Transfer');
    header('Content-Type: application/pdf');
    header('Content-Disposition: attachment; filename=' . basename($file));
    header('Content-Length: ' . filesize($file));
    
    // Read the file and output it to the browser
    readfile($file);
    exit;
} else {
    // File not found
    echo 'File not found';
}
?>

Keywords

header Location redirect download URL PHP

Related Questions