HTTPfy

307 Temporary Redirect

Temporary redirect that requires the client to keep the same method and body.

307 at a glance

Code
307
Name
Temporary Redirect
Class
3xx Redirection
Status
IANA-registered standard code
Defined in
RFC 9110, Section 15.4.8
Cacheable by default
No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 307 means

307 Temporary Redirect behaves like 302 but forbids changing the method: a POST must be re-sent as POST with the same body to the new Location. It is the safe temporary redirect for APIs. Chrome also shows a synthetic "307 Internal Redirect" when it upgrades a URL to HTTPS because of HSTS; that one never leaves the browser.

What typically causes a 307

  • HSTS upgrades inside the browser (DevTools shows Non-Authoritative-Reason: HSTS).
  • Load balancers and storage services redirecting to another region or bucket endpoint (S3 returns 307 while a new bucket's DNS propagates).
  • API gateways moving traffic temporarily.

Fix it on the server

  • Use 307 instead of 302 whenever the request may be a POST, PUT or DELETE.
  • For permanent moves of API endpoints use 308.

Fix it as a client or visitor

  • Most HTTP libraries re-send the body on 307; check yours does, especially for streamed uploads that cannot be replayed.

Headers that go with 307

HeaderRole
LocationTemporary target.
Non-Authoritative-ReasonChrome-only marker on internal HSTS redirects.

Example response

HTTP/1.1 307 Temporary Redirect
Location: https://api-eu.example.com/v1/orders
Content-Length: 0

Opens the HTTP headers tool with your URL filled in; it shows the status line and headers of every redirect hop.

Checking a whole domain's redirects? The HTTP status checker follows http, https, www and non-www variants and shows every hop.