0

I have a web application for testing. It has a login page.

For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, but not signed in. This is ok.

Now the problem is when a successful login happens, they are redirecting the user with a 302 redirect to the dashboard.

Is this normal? I believe a 2xx status code is the best for a successful login.

Is my assumption right?

Is there any security issue related to this?

closed as off-topic by Philipp, Xander, schroeder, symcbean, Mark Nov 20 '14 at 22:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Philipp, Xander, schroeder, Mark
If this question can be reworded to fit the rules in the help center, please edit the question.

4

Redirection the user after a successful login is common in the most webapps.
For instance when the user try to access the dashboard directly within its url, the system keeps the requested url and brings the user to the login page, after user signed in he is redirected to the dashboard not the homepage or something.

  • Okey. I didnt thought about that. – Anandu M Das Oct 16 '14 at 6:18
  • 1
    Use 303 as redirection code. – Gumbo Nov 20 '14 at 22:04
  • Google discussions of the PRG pattern first. There are a lots of pros of cons. – symcbean Nov 20 '14 at 22:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.