Why POST redirects to GET and PUT redirects to PUT?

Question

I am using express 4.13.3 (latest) and following code:

var express = require('express')

var app = express()

app.get('/test', function (req, res, next) {
  res.send('hello!')
})

app.post('/test', function (req, res, next) {
  res.redirect('/test')
})

app.put('/test', function (req, res, next) {
  res.redirect('/test')
})

app.listen(5001)

// GET /test -> 'hello!'
// POST /test -> 'hello!'
// PUT /test -> ERR_TOO_MANY_REDIRECTS

POST redirects to GET but PUT redirects to PUT. Is it possible to make PUT redirect to GET (same as POST)?

score 23 · Accepted Answer · edited May 23 '17 at 12:33

23

Before diving in the details, below is one way of how you could solve the problem:

app.put('/test', function(req, res, next) {
    res.redirect(303, '/test') // Notice the 303 parameter
})

By default Express uses HTTP code 302 for the redirect. According to the HTTP specification, this prevents POST/PUT requests from being redirected as POST/PUT requests and explains what you observed in your code:

If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.

On the other hand, if you use a 303 redirect, the POST/PUT request is allowed to be redirected as a POST/PUT request as explained in this great SO answer:

303: Redirect for undefined reason. Typically, 'Operation has completed, continue elsewhere.' Clients making subsequent requests for this resource should not use the new URI. Clients should follow the redirect for POST/PUT/DELETE requests.

edited May 23 '17 at 12:33

Community

1
1

answered Oct 19 '15 at 13:10

xaviert

5,653
6
29
31

But why express redirects PUT -> PUT and POST -> GET? POST/PUT should be redirected "equally" right? It seems that express automatically uses 303 for POST and 302 for PUT? – user606521 Oct 19 '15 at 13:34
3

@user606521 The most recent HTTP 1.1 spec specifically permits a 302 redirect to change a POST to a GET. (See the relevant quote from the RFC in my answer.) The spec does not allow any other transformations beyond the specific POST-to-GET change, so PUT remains PUT. This is for historical reasons; i.e., browsers implemented the original spec wrong and the spec changed to allow this mistake. – apsillers Oct 19 '15 at 13:56
In my opinion, saying that "By default Express uses HTTP code 302 for the redirect. According to the HTTP specification, this prevents POST/PUT requests from being redirected as POST/PUT requests and explains what you observed in your code" is a misunderstanding of both the specs and the OP concern. First, 302 does not prevent POST/PUT from being redirected as POST/PUT, it prevents the **automatic** redirection of non-GET/HEAD methods. (see aspillers comment for additionnal informations). (1/2) – nvidot Nov 06 '21 at 21:45
Second, the OP clearly states that it sees differents behaviors for this two methods because the specs are not respected by the implementations and this happens in a non-uniform manner (despite what is said about that in the specs). To end this comment, please note that 303 does not only *allow* but **RECOMMEND** that it does induce the use of the GET method (though if it exists valid reasons in particular circumstances, one can do otherwise). (2/2) – nvidot Nov 06 '21 at 21:45

score 15 · Answer 2 · edited Oct 07 '21 at 07:59

First, let's understand what res.redirect does:

res.redirect([status,] path)

Redirects to the URL derived from the specified path, with specified HTTP status code status. If you don’t specify status, the status code defaults to “302 “Found”.

If we look at the HTTP 1.1 spec for a 302 response, we see

Note: For historical reasons, a user agent MAY change the request method from POST to GET for the subsequent request. If this behavior is undesired, the 307 (Temporary Redirect) status code can be used instead.

A 307 request will preserve the HTTP verb in all cases, but that's not want you want. You want the verb to change to GET. In that case, you want a 303:

303 See Other

The 303 (See Other) status code indicates that the server is redirecting the user agent to a different resource, as indicated by a URI in the Location header field, which is intended to provide an indirect response to the original request. A user agent can perform a retrieval request targeting that URI (a GET or HEAD request if using HTTP), which might also be redirected, and present the eventual result as an answer to the original request.

A 303 response will prompt the client (provided it understands HTTP 1.1) to perform a GET request on the specified resource. So, simply provide a 303 status code in your redirects:

res.redirect(303, '/test')

score 1 · Answer 3 · edited Apr 12 '17 at 07:31

1

The way of put is correct, you are redirecting request to another location, but the http method is same. And thats why it is trying to access put again.(You are not changing http method.)

Why post is redirecting to get

Here is answer.

edited Apr 12 '17 at 07:31

Community

1
1

answered Oct 19 '15 at 13:06

Laxmikant Dange

7,606
6
40
65

Why POST redirects to GET and PUT redirects to PUT?

3 Answers3

Linked