I have a web application for testing. It has a login page.
For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, but not signed in. This is ok.
Now the problem is when a successful login happens, they are redirecting the user with a 302 redirect to the dashboard.
Is this normal? I believe a 2xx status code is the best for a successful login.
Is my assumption right?
Is there any security issue related to this?