Issue with session_start(), ob_start() and security

In my web admin area I have using very simple logic:

session_start(); ob_start开发者_运维百科();
if(!isset($_SESSION['user'])){
    header("Location: login.php");
}
contents...
ob_end_flush();

Yes this is working perfect, redirect to login page. But the comic point is that I can see the content of index.php (that protected!!!) here What is wrong?

Abra kadabra

if(!isset($_SESSION['user'])){
    header("Location: login.php");
    die("GET LOST YO");
}

Put an ob_end_clean and exit after the header call to prevent any further execution/output:

if (!isset($_SESSION['user'])) {
    header("Location: login.php");
    ob_end_clean();
    exit;
}

You should make all script content in IF.

session_start(); 
ob_start();
if(isset($_SESSION['user'])){
    contents...
}
else {
    header("Location: login.php");
ob_end_flush();