:::: MENU ::::

Tuesday, February 24, 2009

February 24, 2009

An In-Depth Look at HTTP Redirection

Introduction

Whenever a browser requests a web page, image, CSS file, or other resource the web server returns a response that includes a status code. If the requested resource was found and the requestor is authorized to view it, the web server responds with a 200 status code (and the requested content). If the resource could not be found the web server replies with a 404 status. The HyperText Transfer Protocol (HTTP) standard defines these three-digit status codes and the status codes are grouped by their most significant digit. Status codes in the form 2xx indicate success, whereas status codes in the form 4xx report a client error.

The 3xx range of status codes specifies redirection codes. These are codes that tell the browser that it needs to undertake further action to complete the request. The most common redirection code is 302 Found, which informs the browser that the requested resource is temporarily available at an alternative location. When a web server returns a 302 Found status it must also return a Location HTTP header that indicates where the requested resource has been temporarily moved to. Upon receiving this status code, the browser automatically makes a request for the resource at the specified Location.

This redirection pattern is commonly used in websites that have certain pages that are restricted to a specific set of users. When an unauthorized visitor reaches such a page they are automatically redirected to the log in page. This workflow unfolds because the web server returns a 302 Found status with a Location header pointing to the log in page URL whenever an unauthorized visitor requests a protected page. Figure 1 illustrates this behavior.

Specifying Status Codes Programmatically

The Response object includes a number of properties for specifying the status and Location.

  • Response.Status - a string property that specifies the complete status, which includes a code and description, such as "302 Found".
  • Response.StatusCode - an integer property that specifies just the status code and not the description, such as 302.
  • Response.StatusDescription - a string property that specifies just the status description and not the code, such as "Found".
  • Response.RedirectLocation - a string property that specifies the value of the Location HTTP header.

The following code shows how to use these properties to send a 302 Found status to the browser and have it redirect to Login.aspx.

  1. // Set the status code and description  
  2. Response.StatusCode = 302;  
  3. Response.StatusDescription = "Found";  
  4. // Specify the Location via the RedirectLocation property  
  5. Response.RedirectLocation = "Login.aspx";  
  6. // End processing of the page  
  7. Response.End()  

The Location HTTP header can alternatively be set using the Response.AppendHeader(name, value) method. That is, you could replace the Response.RedirectLocation property assignment in the code above with the following line of code:

  1. // Specify the Location via the AppendHeader method  
  2. Response.AppendHeader("Location", "Login.aspx");  

Fortunately there is a much more succinct version of the above code. The Response.Redirect(url) method executes virtually the same code as above, ending the response and returning a 302 Found status to the browser along with a Location HTTP header with the value specified by the url parameter.

Comparing "301 Moved Permanently" and "302 Found"

Web pages are the interface into your online application and therefore once created should always "work." A website with URLs that once functioned but now return 404 status codes is akin to a buggy desktop application. There are times when you may need to do a site redesign that will shuffle your pages into a new directory structure, or you may have pages that need to be renamed or replaced. In such a circumstance it is better to keep the old URL active and redirect users to the new URL, but rather than redirecting using a 302 Found status you should use the 301 Moved Permanently status.

The 302 Found status emitted by Response.Redirect tells the browser that the requested resource has been temporarily moved. On the other hand, the 301 Moved Permanently status code indicates that the resource has been permanently relocated. Regardless of whether a 301 or 302 status code is returned, the end user's experience is the same. However, search engine crawlers indexing your site treat the two status codes differently. When a 302 Found status code is encountered, a search engine crawler keeps the original page in its index; if it encounters a 301 Moved Permanently, it updates its index with the new URL. Using the 301 Moved Permanently status keeps search engine indexes less cluttered with defunct URLs.

The following code shows how to issue a 301 Moved Permanently redirect:

  1. // Set the status code and description  
  2. Response.StatusCode = 301;  
  3. Response.StatusDescription = "Moved Permanently";  
  4. // Specify the Location  
  5. Response.RedirectLocation = "NewPageUrl.aspx";  
  6. // End processing of the page  
  7. Response.End()  

Unfortunately there is no method in the Response class that provides a succinct 301 Moved Permanently status code, but you could place the above code in an extension method in order to create your own Response.PermanentlyRedirect method.

Further Reading

More