What a 302 redirect means, when to use it instead of 301, and 302 vs 307
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.A 302 sends the client to the Location header for this request only, and the original address stays the one to use next time. RFC 9110 section 15.4.3 defines it. Use it for a short-lived move such as a maintenance page, a campaign link or a redirect after logging in.
Open the page with 302 Found already selected.
Read "When to use it": temporary moves, maintenance pages and short campaigns.
Select 301 in the Codes list to compare it with a permanent move, or 307 to keep the method.
Choose a language under "Send this code in" and press Copy snippet.
Almost every client turns a POST into a GET when following a 302; send 307 when the method must survive.
This HTTP status codes reference lists every registered code from 100 to 511, plus the unregistered ones that nginx, Apache, Laravel and Cloudflare return. Each entry says what the code actually means, when to send it, whether a cache may store the response without cache headers, whether a redirect changes the request method, and which RFC defines it.
Two details most lists get wrong are included here. Cacheability is not a yes or no: RFC 9110 section 15.1 names twelve codes a cache may store with no explicit headers at all, which is why an accidental 404 can stick. And redirects differ: 301 and 302 let a client turn a POST into a GET, 303 always does, while 307 and 308 must repeat the method and body exactly.
Every common code comes with a copyable snippet for raw HTTP, Express, Fastify, FastAPI, Go and PHP, including the header that code requires, such as WWW-Authenticate on a 401 or Allow on a 405. Nothing is sent anywhere; the whole table is in the page.
The rest of the article, and all 6 questions about HTTP Status Codes, are on the HTTP Status Codes page.
Use 401 Unauthorized. It means the server does not know who you are, so a missing, expired or wrong credential belongs there. Use 403 Forbidden only when you know who the caller is and are still refusing. The specification wants a WWW-Authenticate header on every 401.
401 means unauthenticated: send credentials and try again. 403 means authenticated but not allowed: better credentials will not help. If revealing that a record exists is itself a leak, some APIs answer 404 instead of 403 so an attacker learns nothing.
RFC 9110 section 15.1 lists 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501 as heuristically cacheable, and RFC 7725 adds 451. A cache may store those with no Cache-Control or Expires header, which is why a temporary 404 can persist. Every other code needs explicit cache headers.
The specification does not allow it, but nearly every browser does exactly that for 301 and 302. A 303 always turns the next request into a GET. If the method and body must survive the redirect, use 307 for a temporary move or 308 for a permanent one.
Still stuck? Ask about HTTP Status Codes and anybody who knows can answer. No account needed.
On the related tools: Hadolint Online – Run hadolint rules on a Dockerfile in your browser, with no install and no Docker · Readability Checker – Flesch reading ease and grade level, with what to change.
In the collection Debug and Inspect.