HTTP temporary redirect - should I use 302 or one of 303 and 307

Question

Bob Aman's answer on Difference between HTTP redirect codes (Jan 21 '11) says:

I personally recommend avoiding 302 if you have the choice. Many clients do not follow the spec when they encounter a 302. For temporary redirects, you should use either 303 or 307, depending on what type of behavior you want on non-GET requests. Prefer 307 to 303 unless you need the alternate behavior on POST/PUT/DELETE.

However, a recent blog post published on February 18, 2020 titled 301, 302, 303, 307, and 308: Which HTTP Redirect Status Code is for What? says:

Even though status codes 303 and 307 were standardized in 1999, there are still clients that don't implement them correctly. Just like with status code 308, the recommendation, therefore, is to stick with 302 redirects, unless you need a POST request to be repeated (use 307 in this case) or know that intended clients support codes 303 and 307.

So one is recommending using 302 and the other is recommending using either 303 or 307.

What is the correct recommendation?

Answer 1

I also wrote an article about this, and the answer is: it depends. Each redirect has a specific purpose. Why are you redirecting?

I'll copy the relevant bits from the article here:

Are you responding to a POST request, and instead of returning a status immediately, you want to redirect the user to a confirmation page, then use 303 See Other .

Did the resource move to a new path, or a new domain, and you want to make sure that any HTTP client repeats the exact same HTTP request on the new location?

Use 307 Temporary Redirect if the move was temporary, or 308 Permanent Redirect if the move was permanent.

Did the resource move, but you only care about GET request? (perhaps because this is a website).

Use 302 Found if the move was temporary, or 301 Moved Permanently if the move was permanent.

Do you want to send the user somewhere else, but you're not sure where because there's more than one option, and you'd like the user to decide:

Use 300 Multiple Choices .

Compliant clients will understand any redirect and follow the Location header. I can't guarantee that there are non-compliant clients, but I also wouldn't know what they are and I don't believe there's common/popular ones with issues like this. Each of these redirects have worked pretty well for me, except:

1. Nobody does anything with 300 really.
2. Using a the fetch() function in browsers on cross-origin requests seems to not really work with redirects at all, regardless of the status code.