Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Suppose an unauthenticated user tries to get the page which only authorized users can see: /profile/preferences
Is it a normal practice to reply to this with 401 Unauthorized along with the content of the login page or is it better to serve 302 Found redirect to the login page and then send the user back to /profile/preferences?
What are advantages and disadvantages of each method? Can you provide examples of sites using first method?
If you’re talking about a “login page”, you’re using forms authentication. Serving a 401 only makes sense if there’s authentication to be done at the HTTP level (e.g., using basic-auth or digest-auth), because the 401 response has to include a
WWW-Authenticate:header with the challenge for the browser to respond to.Also, if you’re doing forms auth, you almost certainly do not want to serve a 301—your users would never be able to get past your login screen. 🙂 301 is for permanent moves. For something like a redirect for forms authentication, you should use a 302.