302 Found — HTTP Status Code

302 Found is the everyday temporary redirect. The server says the resource is somewhere else for now, gives the address in Location, and expects the client to come back to the original URL next time. Many frameworks use 302 when you call their redirect helper without specifying a code.

What 302 means

RFC 9110 (Section 15.4.3) says 302 means the target resource resides temporarily under a different URI. Because the redirect may change, the client ought to keep using the original URI for future requests. The server should send the temporary URI in Location, and the client may follow it automatically.

The method question is the source of most confusion:

• HTTP/1.0 originally intended 301 and 302 to keep the request method. Early browsers split on this, and practice settled on turning a redirected POST into a GET.
• RFC 9110 accepts that history: a client may change POST to GET when following a 302. If that is not wanted, the RFC says to use 307 Temporary Redirect.
• 303 See Other exists to make the switch to GET explicit, which is the clearer choice after a form submission.

Unlike 301, a 302 is not heuristically cacheable. Browsers and proxies only store it if the response has explicit cache headers.

When you see it

• Authentication walls. An unauthenticated request to /dashboard gets 302 to /login?next=/dashboard.
• Framework defaults. Express res.redirect(), Django's redirect(), Laravel's redirect() and Rails' redirect_to all default to 302 unless you pass a different code or a "permanent" flag.
• Geo, language and device routing. / redirects to /en/ or /de/ based on headers or IP location.
• Experiments and campaigns. A/B tests, short links and tracking URLs that may change their destination.
• Apache's Redirect directive without a status, which defaults to a temporary redirect.

Pitfalls

1. A temporary redirect that is really permanent. HTTP to HTTPS and domain moves usually want 301 or 308. A long-lived 302 still works for visitors but sends a weaker signal to search engines.
2. Losing POST data. An endpoint that receives a form or API POST and answers 302 will see the follow-up arrive as GET without a body. Use 307 if the request must be replayed, or 303 to send the client to a result page on purpose.
3. Login loops. If the login page itself requires a session, or the session cookie is not being set (wrong domain, Secure on HTTP, blocked third-party cookie), the user bounces between the page and the login form until the browser reports too many redirects.
4. Unexpected auth redirects after deploys. A plugin update, a new middleware or a misplaced access rule can put a public page behind a login, and every visitor gets a 302 to the sign-in page.

SEO notes

Google's Search Central documentation treats 302 as a temporary redirect, so the original URL tends to stay in search results. That is the right outcome for real temporary moves, such as a product page redirected during a short promotion. When a move is permanent, use 301 or 308.

How to check it

curl -I https://www.example.com/dashboard

HTTP/2 302
location: /login?next=%2Fdashboard
cache-control: no-cache

To see where a chain of temporary redirects ends, and what each hop answers:

curl -sIL https://www.example.com/dashboard | grep -iE "^(HTTP|location)"

If the last line is a 200 for /login, the page requires a session. If the output keeps repeating the same two URLs, you have a loop.

What it means for uptime monitoring

PingRobot's checker follows redirects and judges only the final response, counting 200 to 399 as up. A 302 is therefore never the verdict itself; what matters is where it leads.

The login redirect is the classic false "up." If a misconfiguration puts your public home page behind authentication, the monitor follows the 302 to the login page, receives a 200, and reports up even though visitors can no longer see the site. A keyword monitor catches this: it searches the first 512 KB of the final body for a word that appears on your real page, not on the login form. Pick something like your headline or a product name.

Two other cases to know:

• A 302 to a page that fails reports that failure, for example a 404 or a 500.
• A redirect loop never produces a final response, so the check fails with an error.

Related codes

• 307 Temporary Redirect — temporary, and the method must not change
• 303 See Other — explicitly fetch another URL with GET
• 301 Moved Permanently — the permanent counterpart
• 401 Unauthorized — how APIs signal missing credentials instead of redirecting
• 403 Forbidden — signed in but not allowed

Start monitoring free — 10 monitors, no credit card.