Location: where the client should go next
Location tells the client where to go: the redirect target on a 3xx response, or the URL of the resource that was just created on a 201.
At a glance
- Direction
- Response only.
- Defined in
- RFC 9110
- When absent
- A 3xx response with no Location gives the client nowhere to go, and most treat it as an error.
- Used with
- 301, 302, 303, 307 and 308, and also with 201 Created
- Relative references
- Allowed, and resolved against the request URL
- Method preservation
- 307 and 308 keep the method and body; 301, 302 and 303 may change it to GET.
- Open redirect risk
- High, whenever the value comes from a query parameter
In detail
On a redirect the header carries the target and the status carries the meaning. The pair that gets confused most often is 302 against 307: historically clients turned a redirected POST into a GET, so 307 and 308 were defined to state explicitly that the method and body must be preserved. If a redirected form submission arrives at the new URL as an empty GET, the status is the reason.
It also appears on a 201 Created, where it is not a redirect at all but the URL of the thing that was just made. A client that follows it automatically is doing so because of its own configuration rather than because the response asked for it, and an API returning 201 without this header forces every client to guess the identifier it just created.
Relative references are permitted and resolved against the request URL, so a value of /dashboard is legal and common. It is also safer behind a proxy, since an absolute URL built from the incoming host can send visitors to whatever hostname the request claimed, and a relative one cannot.
The open redirect is the risk to watch. Any endpoint that takes a destination from the query string and puts it into this header will happily forward visitors to an attacker's site, with your domain in the link that was clicked. Validate against a list of permitted paths, and never accept a full URL from user input.
Examples
HTTP/1.1 308 Permanent Redirect
Location: https://example.com/new-pathHTTP/1.1 201 Created
Location: /api/items/4821
Content-Type: application/jsoncurl -sIL https://example.com/old-path | grep -i '^location:\|^HTTP/'Things that catch people out
- Using 302 for a redirected POST can turn it into a GET and drop the body. Use 307 or 308 when the method must survive.
- Reflecting a user supplied URL into this header is an open redirect, and it is routinely used to make phishing links look like they point at your domain.
- Cross-origin clients cannot read the header unless it is named in Access-Control-Expose-Headers, so a fetch after a 201 sees nothing.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Retry-After: when to try the request again
The two formats Retry-After accepts, which statuses it belongs on, why a fixed value causes synchronised retries, and how clients should treat it.
Host: which site the request is for
Why Host is mandatory in HTTP/1.1, how it maps to the authority in HTTP/2 and HTTP/3, and why trusting it to build URLs creates a real vulnerability.
Access-Control-Expose-Headers: reading response headers
Which response headers page code can read cross-origin by default, how to expose more, and why a pagination or request id header appears empty without it.
Link: relationships expressed in a header
How the Link header carries relationships that markup cannot, its use for preload with early hints, and the pagination pattern that APIs build on it.
Server: what software answered the request
What the Server header conveys, why exposing a version number helps attackers narrow their targets, and what to put there instead of removing it entirely.
Via: the proxies a message passed through
How Via records each intermediary, what the protocol and pseudonym fields mean, how it detects request loops, and why it is useful when debugging a cache.
Tools for this
- Redirect Chain Checker Free online redirect chain checker - trace HTTP redirect chains and hops
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body