Question

I’ve read several documents on the merits of the different HTTP redirect status codes, but those’ve all been very SEO-centric. I’ve now got a problem where search-engines don’t factor in, because the section of the site in question is not publicly viewable.

However, we do want our website to be as accurate / helpful with meta-data as possible, especially for accessibility reasons.

Now, our application takes external links provided by third parties and routes them across an anti-spoofing page with a disclaimer. Since this redirector page can effectively also be embedded via an Ajax call in certain constellations, we also want to strip any query parameters from the referer (for privacy purposes; the target site has no business finding out what internal page the user was on before).

To do this, the confirmation button triggers a server-side script which in turn redirects (rather than just opening the page for the user).

So much as to why our anti-spoofing disclaimer page ends up triggering a redirect.

The question is:

Does it effectively make any difference which status code I use? Do non-typical browsers (e.g. screen-readers) care? If so, what’s the best practise for such redirects? The most semantically sound, if you so will? They all seem various degrees of insincere to me.

I’m thinking of a 302 – but as it makes no sense trying to bookmark the page (it’s protected with a crsf token), so there’s probably no harm in a 301, either, is there? So I’m wondering if there’s a reason for me to prefer the one over the other.

Answer 1

Hmm. Here’s the list. 301 sounds okay (emphasis mine):

The requested resource has been assigned a new permanent URI and any future references to this resource SHOULD use one of the returned URIs. Clients with link editing capabilities ought to automatically re-link references to the Request-URI to one or more of the new references returned by the server, where possible.

302 doesn’t fit n my opinion:

The requested resource resides temporarily under a different URI

However, my favourite is 303 see other:

The response to the request can be found under a different URI and SHOULD be retrieved using a GET method on that resource. This method exists primarily to allow the output of a POST-activated script to redirect the user agent to a selected resource. The new URI is not a substitute reference for the originally requested resource.

But that might be so rare (I’ve never seen it used in the wild) that some clients may not understand it – which would render your desire for maximum compatibility moot. 301 is probably the closest choice.