< HTTP/1.1 307 Temporary Redirect

TL;DR: 307 Temporary Redirect is 302 with a guarantee: the client must repeat the same method and body at the new Location. Use it for temporary redirects of POST/PUT/DELETE; use 303 when you want the follow-up to be a GET.

What it means

POST /api/orders HTTP/1.1
Host: api.example.com
Content-Type: application/json

{"sku":"A1","qty":2}

HTTP/1.1 307 Temporary Redirect
Location: https://api-eu.example.com/api/orders

The client resends POST /api/orders with the same JSON body to the new host (RFC 9110 section 15.4.8). With a 302, browsers and many HTTP libraries switch to GET and drop the body. Like 302, a 307 is not cacheable unless the response carries explicit freshness headers.

The 307 you did not send

Chrome DevTools shows 307 Internal Redirect with Non-Authoritative-Reason: HSTS when the browser upgrades http:// to https:// by itself because of a cached Strict-Transport-Security policy. No network request happens and no server is involved, so server config cannot fix it. Clear the entry at chrome://net-internals/#hsts or correct the policy. See Strict-Transport-Security.

Redirect behavior matrix

Code	POST becomes GET?	Permanent	Typical use
301	Usually yes	Yes	Moved pages
302	Usually yes	No	Login and promo redirects
303	Always	No	After a POST, show a result page
307	Never	No	Temporary API/endpoint redirect
308	Never	Yes	Endpoint moved for good

Compare in detail: 302 vs 307.

Gotchas

• Request bodies must be replayable. A client that streamed a large upload may be unable to resend it, and some libraries fail with an error rather than follow the 307. curl replays the body.
• Credentials on cross-origin redirects. Browsers and most HTTP libraries strip Authorization when a redirect leaves the origin, so authenticated calls can arrive at the new host as 401.
• CORS preflight. A preflight (OPTIONS) response must not be a redirect; browsers reject it with “Redirect is not allowed for a preflight request”. Redirect the actual request, not the OPTIONS.
• No SEO transfer. Search engines treat 307 as temporary, like 302.
• Next.js: permanent: false in redirects() sends 307; permanent: true sends 308.

Implementation

Express

app.post('/api/orders', (req, res) => {
  res.redirect(307, 'https://api-eu.example.com/api/orders')
})

nginx

location /api/ {
    return 307 https://api-eu.example.com$request_uri;
}

Cloudflare

Choose status code 307 in a Single Redirect rule or a Bulk Redirect to preserve the method.

Reproduce with curl

curl -si -L -X POST -H 'Content-Type: application/json' \
  -d '{"sku":"A1","qty":2}' https://api.example.com/api/orders

Add -v and confirm the second request line still reads POST and carries the body.

Related

• 302 Found
• 303 See Other
• 308 Permanent Redirect
• Location header