php - how to redirect to secure section of website with Login script created in redbeanphp -

$email = trim($_post['email']);         $pass = md5(trim($_post['password']));         $user = r::findone("user"," email = ? , password = ? ", array($email,$pass));         if($user != null) {             // login             header('location: http://www.google.com/');         } else {             // bad login         } 

now framework provided in redbean create login script in file runs when submit form on website -

require_once('xyz.class.php'); if (isset($_request['apiname']) && $_request['apiname'] != null) {     $apiname = $_request['apiname'];     switch ($apiname) {         case 'requestsignup':             echo uberhealth::requestsignup($_request['email']);             break;         case 'contact':             echo uberhealth::contact($_request['email'], $_request['msg'], $_request['name'], $_request['subject']);             break;         ...     } } 

and xyz.class.php has redbean functions logging in / sign etc. when login through script gives me error on console -

xmlhttprequest cannot load http://www.google.com/. no 'access-control-allow-origin' header present on requested resource. origin 'http://localhost' therefore not allowed access. 

i have tried

return header('location: http://www.google.com/'); return json_encode(header('location: http://www.google.com/')); 

instead of header('location: ...'));

but gave same error.

i think you're missing access-control-allow-origin header, message said :)

here same question on so.

edit: address header alternative question far understood you're searching alternative approach header redirects. typically php frameworks know use bootstrapping mechanisms build user output. take @ rude graphic below:

essentially request client handled via main entry point (index.php) depending on url style either use hashes, or parts of querystring determine navigate to. thats job of bootstrapper find out: "ok user want's visit page xyz". next layer authorization amongst others. here check whether user has permission or not if continue bl , render result returned client.

so whole sequence takes place during initial request client no redirecting needed. detailed examples take how well-known frameworks job.