0

I see a lot of websites that do a redirect to another page after a user logs in. Sometimes I even see websites that show something like You will be redirected in 5 seconds... while showing in the header that the user is not logged in.

All I would do is to create the session before doing anything else and then show the home page or something like that. Is this bad practice? And if yes, why?

0

1 Answer 1

0

It's not bad practice to redirect directly without showing a redirect page, this mechanism is used in huge network sites like google because Cookies are valid on only one sub-domain and big sites have lots of sub-domains. when you login on youtube.com, you are redirected to accounts.google.com where you enter your credentials. next time you login on another google website accounts.google.com will retrieve the cookie that says you're logged in and you won't have to enter your credentials. But on a small website with only one domain you don't need a redirect website

4
  • The OP mentioned redirecting to another page, not necessarily another website. Oct 21, 2014 at 9:42
  • @SilverlightFox for some reason, I highly doubt you even understood the question.. I was explaining why the redirect page is used, and why he doesn't need one Oct 21, 2014 at 13:41
  • You do need to redirect after login, otherwise the credentials in the POST data are cached and can be resubmitted using refresh. Oct 21, 2014 at 13:58
  • @SilverlightFox you can't be serious. I've made login systems all my life and never have I used a redirect page. none of the websites using my login systems have ever had a security breach. Oct 21, 2014 at 14:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.