HTTP 307 Temporary Redirect – Free, Online, Private

What HTTP 307 means

307 is a temporary redirect that must not change the method. A POST stays a POST, and the body is sent again to Location. The client should use the original URL for the next request. It is the temporary partner of 308, and the method-preserving partner of 302.

307 Temporary Redirect belongs to the 3xx redirection class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 307

When you see HTTP 307 Temporary Redirect, stop on that exact status line. 307 Temporary Redirect sends the client to another URI and keeps the method and body. The trace that usually produces it: A write endpoint moved for an hour and the client replayed the POST. The 3xx redirection class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

Use 307 when a temporary URL change must replay the same request, such as a POST during a short-lived routing change. Use 302 or 303 if the follow-up should be a GET. Use 308 if the change is permanent. Do not use 307 for a login page if you do not want the original POST body delivered to the login URL.

How to fix HTTP 307

To fix HTTP 307, change the condition that made the server choose Temporary Redirect. Repeat the request at Location with the same method and body. Next time, try the original URL first. Refuse to follow 307 to an untrusted host if the body contains a secret. If the follow-up fails, retry policy depends on the method. The redirect itself is not a failure. A loop is a failure. Stop after a small number of hops. If the log line is a different code, leave this page. The mix-up people make with 307 is this one: 302 may change POST to GET. 303 requires GET. 301 is permanent and may change the method. 307 is temporary and keeps the method.

• Location pointed at a host that was not ready to receive the body.
• A client stripped the body anyway, because it treated 307 like 302.
• The redirect looped because both URLs answered 307 to each other.

An access log that only stores 307 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 307 Temporary RedirectHTTP/1.1 307 Temporary Redirect
Location: /v2/items

The next request uses the same method and body against /v2/items. Sensitive bodies therefore move to that URL. Only redirect to a host you trust with the body. Relative Location is resolved against the original request.

What the client should do

Repeat the request at Location with the same method and body. Next time, try the original URL first. Refuse to follow 307 to an untrusted host if the body contains a secret.

307 is not cached unless the response explicitly allows it. A cached temporary redirect becomes a permanent one in practice.

If the follow-up fails, retry policy depends on the method. The redirect itself is not a failure. A loop is a failure. Stop after a small number of hops.

Codes people confuse with HTTP 307

302 may change POST to GET. 303 requires GET. 301 is permanent and may change the method. 307 is temporary and keeps the method.