This is the first I had heard of GETs to login pages executing a redirect when the user is already logged in. I wasn't aware that so many did this. Virtually

This is the first I had heard of GETs to login pages executing a redirect when the user is already logged in. I wasn't aware that so many did this. Virtually every application I have built will render a simple response saying "You are already logged in" if you GET the login URL with an active session. As I understand the exploit, if a non-image is returned, the script assumes you are not logged in. What value is there in redirecting a GET if you're already logged in? You redirect when the login form is submitted as a POST.