authentication - A web page that requires login should redirect to the login page or simply display the form?

Question

When a web page offers content that require the user to log in there are two ways to have them authenticate themselves:

1. The web application stores the URL, then redirects to a separate login page, then upon a successful authentication it redirects back to the stored URL;

2. Instead of the protected content the page displays the login form (staying at the same URL), and after a successful login action the page refreshes and the real content appears.

I'd like to know the following:

• If I go with option 1 what would be the correct http status code to use? (302 is probably the correct one, so I am listing this question here only for the sake of completeness.)
• What would be the appropriate http status code for option 2? 401 is tempting but I don't wish to use http authentication.
  • A sub-question: why is http authentication so uncommon?
• How can I ensure that crawlers won't associate the protected content's title, keywords, description and other meta data with the login form?

And actually this is what I'd really like to know:

• Do http status codes matter in above cases at all? Are there any pragmatic benefits from using proper status codes?

Answer 1

您想使用选项 1。这样做的原因是，如果您在每个需要登录的 URL 上显示表单，您将遇到两个问题：

1. 搜索引擎会认为登录表单是该 URL 的实际内容，而不是真实内容。显然这不是你想要的。
2. 谷歌将看到所有这些页面重复内容，这是一件坏事。他们的 Panda 算法专门针对大量重复内容，这可能会导致您的整个网站因低质量内容而受到惩罚。

正如您已经发现的那样，使用 302 重定向将是执行此操作的正确方法。并且使用正确的状态码确实很重要。搜索引擎解释它们的含义并发送错误的状态代码可能会导致负面后果。由于发送正确的 HTTP 状态代码很容易，因此绝对值得这样做。