Empty Location header can cause unpredictable behaviour

If you specify a blank location HTTP header then you can expect different behaviour between browsers.

Take the following PHP code for example:

header( "Location: " );

In Internet Explorer, a blank location will redirect the user to the root of the current folder ("./"). In Firefox, the user is not redirected at all.

ASP is a little smarter in that Response.Redirect("") will give you an error message indicating that you're missing the URL. Although, you can duplicate the redirection problem with the following code:

Response.Status="302 Moved Permanently"
Response.AddHeader "Location", ""

Why is this an issue? Specifically, if you're using variables for redirection and the variable is empty or null then you will run into this problem. If you wanted it to redirect to the root of the current folder then the error may not be evident until you tested in something other than Internet Explorer.

Published January 26, 2005 · Updated September 17, 2005
Categorized as Servers
Short URL: https://snook.ca/s/319

Conversation

1 Comment · RSS feed
1
Ben Kennedy said on January 31, 2005

In the past, I've used relative paths (e.g. "Location: foo.php") before I got wise to the fact that per spec it must actually be an absolute URI. However, any browser that I tested the code under always seemed to work as intended despite the missing URL-scheme or hostname. I wonder if that is the case with all browsers these days.

-b

Sorry, comments are closed for this post. If you have any further questions or comments, feel free to send them to me directly.