It is normal, it indicates only that the page has been "moved" and Location: will indicate where the user should go.

This Wikipedia publication on HTTP codes is enough to answer:

  

3xx Redirect

     

Found

     

This is an example of good industrial practice contradicting the rule.   HTTP / 1.0 specification (RFC 1945) required the client to perform a   temporary redirect (which describes the original phrase was "Moved   Temporarily "), but popular browsers run 302 with the   303 See Other. Therefore, he added   HTTP / 1.1 status codes 303 and 307 to distinguish between the two   behaviors. However, most Web applications and   still use status code 302 as if it were 303.

Font

CURL by default will not follow redirects, this is a somewhat insecure practice, even with the standard cURL limitations.

To enable redirects (follow the Location: header):

curl_setopt_array($token, [
     //...
     CURLOPT_FOLLOWLOCATION => true
]

To set the redirect limit, you can use CURLOPT_MAXREDIRS , where 10 is the limit defined by me, if -1 is unlimited:

CURLOPT_MAXREDIRS => 10

To define which protocols can be used, for example HTTP and HTTPS :

CURLOPT_REDIR_PROTOCOLS => CURLPROTO_HTTP | CURLPROTO_HTTPS

To use the same method for redirection use the command below, so if you do a POST it (and the content sent) will be sent to the redirected location:

CURLOPT_POSTREDIR => 2

If you want cURL to update referer based on Location you can also use:

CURLOPT_AUTOREFERER => 1

Using CURLOPT_HEADER => TRUE you will get all the headers, of all the requests made, this may explain why:

HTTP/1.1 302 Found
//...

HTTP/1.1 200 Ok
//...

This indicates that the first request returned 302 and the second 200 , for example. Of course, it can occur to be 302 - > 404 , or 302 - > 403 .

In addition if you want to get the URL of the last request made, you can also use the command:

echo curl_getinfo($token, CURLINFO_EFFECTIVE_URL);

If you want to get the latest HTTP you can also use:

echo curl_getinfo($token, CURLINFO_HTTP_CODE);

By default, cURL does not allow redirects for the file and SCP protocol in version 7.19.4 and in version 7.40.0 the SMB and SMBS protocol are also not followed. But everything else is followed, including gopher , stmp , ftp , which may be a potential risk, but I do not think it matters here.