Challenge 3 — Solution

Task: Write a small "protected page" pattern: a function requireLogin()
that checks $_SESSION['loggedIn'], redirecting to "login.php" with
header() + exit if not set. Then write a logout script that clears the
session and destroys it. Explain in a comment why exit is essential
right after the header() redirect call.

<?php
    session_start();

    function requireLogin() {
        if (!($_SESSION['loggedIn'] ?? false)) {
            header("Location: login.php");
            exit;
        }
    }

    // Usage on any page that needs protecting:
    requireLogin();
    echo "This content is only visible to logged-in users.";


    // ---- logout.php ----
    // <?php
    //     session_start();
    //     $_SESSION = [];
    //     session_destroy();
    //     header("Location: login.php");
    //     exit;
    // ?>

    // Why exit is essential right after header("Location: ..."):
    // header() only sends an HTTP instruction telling the BROWSER to
    // navigate to a different URL - it does not stop PHP itself from
    // continuing to run the rest of the script on the server. Without
    // exit immediately afterward, requireLogin() would send the
    // redirect header, but then return control back to the calling
    // page, which would keep executing and could still echo protected
    // content into the response body. Depending on network timing, the
    // browser might display that leaked content briefly before it
    // actually processes the redirect - a real, avoidable security gap
    // that exit closes completely by halting the script the instant
    // the redirect is issued.
?>


Output:
(If $_SESSION['loggedIn'] is not set: a redirect to login.php happens,
and nothing further from the calling script executes. If it IS set:)
This content is only visible to logged-in users.

Notes:
- requireLogin() is designed to be called once, near the top of any
  page that should be protected - reusing this one function across
  many pages avoids repeating the same isset()/header()/exit logic
  everywhere.
- The logout script clears $_SESSION to an empty array AND calls
  session_destroy() - clearing the array alone would remove the data
  but leave the session itself technically still active on the server;
  session_destroy() removes the session completely.
- Both the login-check and the logout script call session_start()
  first, matching the chapter's own rule that session_start() must run
  on every single page that reads or writes $_SESSION, not just the
  page where the session was originally created.