how to redirect to secure section of website with Login script created in redbeanphp

Question

$email = trim($_POST['email']);
        $pass = md5(trim($_POST['password']));
        $user = R::findOne("user"," email = ? AND password = ? ", array($email,$pass));
        if($user != NULL) {
            // good login
            header('Location: http://www.google.com/');
        } else {
            // bad login
        }

Now the framework we are provided already in redbean to create the login script is in this file which runs when we submit any form on website -

require_once('xyz.class.php');
if (isset($_REQUEST['apiName']) && $_REQUEST['apiName'] != null) {
    $apiName = $_REQUEST['apiName'];
    switch ($apiName) {
        case 'requestSignUp':
            echo UberHealth::requestSignUp($_REQUEST['email']);
            break;
        case 'contact':
            echo UberHealth::contact($_REQUEST['email'], $_REQUEST['msg'], $_REQUEST['name'], $_REQUEST['subject']);
            break;
        ...
    }
}

and xyz.class.php has redbean functions for logging in / sign up etc. Now when i login through this script this gives me an error on console like -

XMLHttpRequest cannot load http://www.google.com/. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access.

I have tried

return header('Location: http://www.google.com/');
return json_encode(header('Location: http://www.google.com/'));

instead of just header('Location: ...'));

But gave the same error.

Answer 1

I think you're missing the Access-Control-Allow-Origin header, as the message said :)

Here is the same question on SO.

Edit: To address your header alternative question As far as I understood you're searching for an alternative approach for header redirects. Well typically PHP Frameworks I know use some Bootstrapping mechanisms to build the user output. Take a look at my rude graphic below:

Essentially the request from the client will always be handled via a main entry point (index.php) where you depending on the url style either use hashes, or parts of the querystring to determine where to navigate to. Thats the job of the bootstrapper to find out: "Ok the user want's to visit Page XYZ". The next layer could be the Authorization amongst others. Here you would check whether the user has the permission or not if so continue to your BL and render the result which then is returned to the client.

So this whole sequence takes place during the initial request from the client thus no redirecting would be needed. For detailed examples take a look how well-known Frameworks do the Job.