Wrong password results in 303 redirect. Why not 401?

ℹ️ Support
1

Nextcloud version (eg, 20.0.5): 29.0.0.19
Operating system and version (eg, Ubuntu 20.04): debian bookworm, docker
Apache or nginx version (eg, Apache 2.4.25): nginx 1.26
PHP version (eg, 7.4): 8.2.19

2FA enabled.

I was wondering why entering a faulty password or non existent username results in a http redirect 303 and not 401?

2

Can you post more details e.g. the full URL including get parameter? You can find it in browser dev tools press F12 and then network analysis.

3

First of all, I’m not an expert, but my instance does the same thing and I think this is by design and not a bug.

As for your actual question about why 303 is used instead of 401, the following thread on Stack Overflow may provide some insight: https://stackoverflow.com/questions/2839585/what-is-correct-http-status-code-when-redirecting-to-a-login-page