HTTP 307 Temporary Redirect: Strict Method and Payload Preservation
The HTTP 307 status code was created in HTTP/1.1 (RFC 7231) to resolve ambiguities surrounding the 302 Found code. With a 307 redirect, the client is strictly forbidden from changing the HTTP request method: if a client sends a POST request with a JSON payload, it must re-issue the exact same POST request with the same body payload to the new Location URI.
Modern web browsers also use a synthetic "307 Internal Redirect" when enforcing HTTP Strict Transport Security (HSTS). This internal browser mechanism automatically redirects insecure http:// links to https:// without transmitting cleartext traffic over the network.
How to Implement 307 Redirects in Nginx & Modern APIs
Nginx API Failover (307)
# Temporary API failover preserving POST data
location /api/v1/payments {
return 307 https://backup.api.example.com/api/v1/payments;
}Next.js App Router (route.ts)
import { NextResponse } from 'next/server';
export async function POST(request: Request) {
return NextResponse.redirect(
new URL('/api/v2/endpoint', request.url),
307
);
}Frequently Asked Questions About 307 Redirects
What is an HTTP 307 Temporary Redirect status code?
An HTTP 307 Temporary Redirect status code indicates that the target resource resides temporarily under a different URI. Crucially, the user agent MUST NOT change the request method when following the redirect: a POST request must be repeated with POST, preserving its original body payload and headers.
What is the critical difference between HTTP 302 and HTTP 307?
When encountering a 302 redirect, many browsers historically rewritten POST requests into GET requests. In HTTP/1.1 (RFC 7231), HTTP 307 was introduced to strictly enforce that the request method and body payload remain identical across the redirect hop.
Why do browsers show 307 Internal Redirect for HSTS websites?
When a domain is enrolled in HTTP Strict Transport Security (HSTS), the browser creates an internal synthetic 307 redirect from http:// to https:// without making an insecure plaintext request to the network, preventing man-in-the-middle downgrade attacks.
How do search engines handle 307 redirects for SEO rankings?
Because 307 is temporary, search engine crawlers like Googlebot keep the original URL indexed and do not pass full PageRank link equity to the target address. If your intent is a permanent site migration or canonical change, configure a 301 or 308 redirect instead.
When should software engineers implement an HTTP 307 redirect?
Use HTTP 307 in RESTful APIs and modern web applications during temporary maintenance, server failover, or load balancing when users or API clients are submitting data via POST, PUT, or DELETE methods that must not be converted to GET.