3xx Redirection

307 Temporary Redirect

The requested resource has been temporarily moved. The client MUST preserve the original HTTP method and body when following the redirect.

Meaning & Description

The HTTP `307 Temporary Redirect` redirect status response code indicates that the resource requested has been temporarily moved to the URL given by the `Location` header.

The critical difference between a 307 and a 302 is that 307 guarantees that the HTTP method and body will not change when the client follows the redirect. If the original request was a `POST` with a JSON payload, the subsequent request to the new URL will also be a `POST` with the exact same JSON payload. This fixes the historical ambiguity of the `302 Found` status code.

Common Causes

  • Temporary API version routing.
  • Maintenance windows routing write traffic to a backup server.
  • Strict load balancers forwarding mutating requests.

How to fix a 307 error

  1. Verify that the target URL specified in the `Location` header is capable of handling the original HTTP method (e.g., if you redirect a POST, the target must accept POST).
  2. Ensure your client is configured to follow redirects. (Some HTTP clients drop the body on redirects for security reasons, even on a 307).
  3. If you actually wanted the client to switch to a GET request (like after a successful form submission), you used the wrong code; switch to `303 See Other`.

Browser & SEO Behaviour

Browser Behavior

Browsers immediately follow the redirect. Crucially, they will resend the original request method (e.g., POST) and the original request body to the new URL without asking the user for confirmation.

SEO Impact

Similar to a 302. Search engines treat it as a temporary move. They will follow the redirect but will keep the original URL indexed. Link equity is not passed.

CDN Behavior

CDNs do not typically cache 307 responses, especially if they are the result of a POST request.

Code Examples

Raw HTTP 
HTTP/1.1 307 Temporary Redirect
Date: Mon, 12 Sep 2026 12:00:00 GMT
Location: https://backup-api.example.com/v1/users
Content-Length: 0
Node.js (Express)
app.post('/v1/users', (req, res) => {
  // API is temporarily down, route to backup server
  // 307 ensures the client POSTs their payload to the backup
  res.redirect(307, 'https://backup.api.com/v1/users');
});
Python (FastAPI)
from fastapi import FastAPI
from fastapi.responses import RedirectResponse

app = FastAPI()

@app.post("/v1/users")
def create_user():
    # FastAPI RedirectResponse uses 307 by default
    return RedirectResponse(url="https://backup.api.com/v1/users")
Go 
func handler(w http.ResponseWriter, r *http.Request) {
    // 307 Temporary Redirect preserves the method and body
    http.Redirect(w, r, "https://backup.api.com/v1/users", http.StatusTemporaryRedirect)
}
C# (ASP.NET Core)
[HttpPost("v1/users")]
public IActionResult CreateUser()
{
    // Preserves the POST method when redirecting
    return RedirectPreserveMethod("https://backup.api.com/v1/users");
}
curl 
# Without --post301/--post302/--post303 curl will preserve POST on 307 automatically if -L is used
curl -X POST -d "name=Alice" -I -L http://example.com/api

Raw HTTP Response Example

HTTP Response
HTTP/1.1 307 Temporary Redirect
Location: https://backup-api.example.com/v1/users
Content-Length: 0
Connection: close

Real-world Examples

HSTS (HTTP Strict Transport Security): Modern browsers internally use a pseudo-307 redirect to upgrade HTTP requests to HTTPS before they even leave the browser.
GraphQL Gateways: Used to temporarily route POST mutations to different microservices during rolling deployments without dropping the mutation payload.
Payment Gateways: Occasionally use 307s in complex 3D Secure authentication flows to pass transaction data between the merchant and the bank.

Frequently Asked Questions

What is the exact difference between 307 Temporary Redirect and 302 Found?

Historically, browsers changed POST requests to GET requests when following a 302. A 307 strictly forbids this behavior. It guarantees that if the original request was a POST, the redirected request will also be a POST.

When should I use 307 instead of 308?

Use 307 when the move is temporary (e.g., during maintenance or A/B testing). Use 308 Permanent Redirect when the endpoint has moved forever and you want clients to update their hardcoded URLs.

Can I use 307 for redirecting a GET request?

Yes. For GET requests, 302 and 307 behave exactly the same. However, 302 is universally understood and slightly more common for simple GET redirects (like login routing).

Are there any security risks with 307 redirects?

Yes. If an attacker finds an open redirect vulnerability that returns a 307, they can trick a user into POSTing sensitive data (like login credentials) to an attacker-controlled server.

Why does my HTTP client throw an error on 307?

Some strict HTTP clients require explicit configuration to follow redirects on POST requests to prevent accidental data leakage across domains.

Did You Know?

The 307 status code was created in HTTP/1.1 specifically to fix the chaotic implementation of the 302 status code by early browser vendors.

When a site has HSTS enabled, your browser fakes a 307 Internal Redirect to upgrade http:// to https:// without ever hitting the network.

Developer Tips

  • Use 307 as your default temporary redirect for APIs to ensure you never accidentally drop a payload.
  • Never use 307 for the POST/Redirect/GET pattern (form submissions). If you use 307, the browser will POST the form data again to the success page. Use 303 See Other instead.
  • Always validate target URLs when issuing a 307 redirect to prevent sensitive payloads from being forwarded to untrusted domains.

Interview Questions

These are questions you might face in a backend or API design interview that touch on HTTP 307.

Explain why the 307 and 308 status codes were added to the HTTP specification when 302 and 301 already existed.

Because early web browsers broke the spec. They changed POST requests to GET requests when following 301 and 302 redirects. To allow developers to guarantee that a POST remains a POST when redirected, 307 (temporary) and 308 (permanent) were introduced.

If a user submits a checkout form (POST), and you want to redirect them to a receipt page (GET), which HTTP status code should you use? 307 or 303?

You must use 303 See Other. A 303 explicitly forces the client to drop the POST payload and use a GET request. If you used a 307, the browser would attempt to POST the checkout data again to the receipt page.

What happens if a client sends a POST request with a 5MB file upload and receives a 307 redirect?

The client must re-upload the entire 5MB file to the new URL specified in the Location header. This can cause latency and bandwidth issues, so redirecting large uploads should be avoided if possible.

Common Interview Mistakes

  • Confusing 307 with 303 (preserving the method vs changing to GET).
  • Not knowing that 307 is the temporary counterpart to 308.
  • Failing to mention the security implications of redirecting a POST payload to a new domain.