Header Location redirects to 200 instead of 302

[engageub]

Hi,

The following code has been part of the system for several years. However, a recent issue prevented the browser from redirecting as expected.

Typically, the code performs a redirection to a new URL with an HTTP status code of 302. Unfortunately, for one specific website, the redirection failed, and instead of a 302 response, the server returned an HTTP 200 status code.

When the new URL is pasted directly into the browser, the website works fine. However, the issue arises when the redirection is triggered through the code.

This issue has now been resolved, but we would like to understand the circumstances under which this behaviour occurs and how to replicate it.

Could this be related to the website’s response time? If so, why does the PHP backend need to account for this particular website and return an HTTP 200 status code instead of the expected 302?

 

            header('Referrer-Policy: unsafe-url');

            header('Location: ' . $result['shortenedUrl']);

            exit;

 

 

Thank you

[gizmola]

 

On 6/8/2025 at 7:18 AM, engageub said:

 

This issue has now been resolved, but we would like to understand the circumstances under which this behaviour occurs and how to replicate it.

Could this be related to the website’s response time? If so, why does the PHP backend need to account for this particular website and return an HTTP 200 status code instead of the expected 302?

 

            header('Referrer-Policy: unsafe-url');

            header('Location: ' . $result['shortenedUrl']);

            exit;

 

 

PHP will set the response code to be a 302, when it issues the Location header.   If this same code was running, but it was sending a 200, that could be because either the webserver or something in the code has already set the response code.

We have no context or information on what triggers this code.  The only other thought I could contribute is that a 302 should not be used if the redirect is being issued in response to a POST request, you should not use the 302, but instead issue a 307.  This is discussed here.