Are the situations when header-redirect should be replaced with JS-redirect?

Question

Years ago I struggled with what I believe was a browser bug as header-redirect on post containing multipart/form-data didn't work stable enough.

By habit, I still use JS-redirect when dealing with multipart/form-data, instead of header-redirect. In essence:

echo "<script>document.location = 'receipt.php';</script>";
//instead of
header('Location: receipt.php');

Question: Are there (still) situations when header-redirects should be avoided in favour of JS-redirect (apart from specific functional reasons such as bandwith-checking etc).

UPDATE Ran in to PHP - Set cookie and redirect

Is set-cookie + redirect http compliant or not?

Also under: Why can't I set a cookie and redirect?

Answer 1

Basically there are three types of redirects

Header-Redirect

Use header-redirect when you dont need to show anything to the user, like a successfull post on a forum, where you redirect him directly to the thread.

Keep in mind that you can only use header-redirect if there has not been sent any output to the client, else it wont work.

JS-Redirect

Use js-redirect if you want to show something to the user, like

your request has been sent, you will be redirected in 3 seconds

in this case your code should look like this:

<script>
    setTimeout(function(){
                  document.location = 'receipt.php';
               }, 3000);
</script

Also, you can use JS-redirect if you have no control about previous code, so you cannot use a header-redirect.

JS-redirect will show up the site in the browser-history

Keep in mind that a JS-redirect will NOT work, if the user has disabled javascript.

HTML-Redirect

3rd option for redirects would be via html-meta-tag:

<meta http-equiv="refresh" content="3; URL=receipt.php">

this will redirect after 3 seconds and will also work if javascript is disabled.

I strongly recommend using header-redirects whenever possible, it's a much better user-experience

Answer 2

A Javascript redirect is not HTTP compliant in any way. Any client which only understands HTTP will not be able to follow it. Even clients which do evaluate Javascript will treat it differently than they'd treat an HTTP 3xx status. For example, the redirect page will appear as a regular page in the browser's history, when this may not be desired at all. Search engines will treat the page as a regular page instead of as an interstitial. Further, a 301 Moved Permanently redirect is treated with special rules which cannot be replicated by Javascript.

The only time you would ever use a Javascript redirect is as augmentation to the regular page. E.g., you return some sort of "action successful!" page and invite the user to "click here to return to homepage" or such; on such a page it makes sense to automatically redirect to the homepage after a few seconds. But this is only a convenience addition, it's not the primary or only thing this page does.