diff --git a/packages/fresh/src/context.ts b/packages/fresh/src/context.ts index abc94082a63..acc0e65030e 100644 --- a/packages/fresh/src/context.ts +++ b/packages/fresh/src/context.ts @@ -165,7 +165,7 @@ export class Context { * ctx.redirect("//evil.com/"); * ``` */ - redirect(pathOrUrl: string, status = 302): Response { + redirect(pathOrUrl: string, status = 307): Response { let location = pathOrUrl; // Disallow protocol relative URLs diff --git a/packages/fresh/src/context_test.tsx b/packages/fresh/src/context_test.tsx index b39dac1eb11..09f7dea03ac 100644 --- a/packages/fresh/src/context_test.tsx +++ b/packages/fresh/src/context_test.tsx @@ -7,24 +7,27 @@ import { BUILD_ID } from "@fresh/build-id"; import { parseHtml } from "../tests/test_utils.tsx"; Deno.test("FreshReqContext.prototype.redirect", () => { + // Default status is now 307 to preserve HTTP method on redirect + // See: https://github.com/denoland/fresh/issues/2632 let res = Context.prototype.redirect("/"); - expect(res.status).toEqual(302); + expect(res.status).toEqual(307); expect(res.headers.get("Location")).toEqual("/"); res = Context.prototype.redirect("//evil.com"); - expect(res.status).toEqual(302); + expect(res.status).toEqual(307); expect(res.headers.get("Location")).toEqual("/evil.com"); res = Context.prototype.redirect("//evil.com/foo//bar"); - expect(res.status).toEqual(302); + expect(res.status).toEqual(307); expect(res.headers.get("Location")).toEqual("/evil.com/foo/bar"); res = Context.prototype.redirect("https://deno.com"); - expect(res.status).toEqual(302); + expect(res.status).toEqual(307); expect(res.headers.get("Location")).toEqual("https://deno.com"); - res = Context.prototype.redirect("/", 307); - expect(res.status).toEqual(307); + // Explicit 302 still works for backward compatibility + res = Context.prototype.redirect("/", 302); + expect(res.status).toEqual(302); }); Deno.test("render asset()", async () => {