Serving login form via 401 Unauthorized

Question

Suppose an unauthenticated user tries to get the page which only authorized users can see: /profile/preferences

Is it a normal practice to reply to this with 401 Unauthorized along with the content of the login page or is it better to serve 302 Found redirect to the login page and then send the user back to /profile/preferences?

What are advantages and disadvantages of each method? Can you provide examples of sites using first method?

Answer 1

If you're talking about a "login page", you're using forms authentication. Serving a 401 only makes sense if there's authentication to be done at the HTTP level (e.g., using basic-auth or digest-auth), because the 401 response has to include a WWW-Authenticate: header with the challenge for the browser to respond to.

Also, if you're doing forms auth, you almost certainly do not want to serve a 301—your users would never be able to get past your login screen. :-) 301 is for permanent moves. For something like a redirect for forms authentication, you should use a 302.