Overview

Location is a response header that points to a redirect target or the URL of a newly created resource. On 3xx responses the browser auto-navigates to it; on 201 Created it tells you where the just-created resource lives.

The value may be an absolute or a relative URL; relative URLs are resolved against the request URL.

Details

Each redirect status has a distinct meaning. 301 (permanent) and 308 mean the URL moved permanently; 302 and 307 mean a temporary move. The key difference is method preservation: 301, 302, and 303 may cause the browser to switch the follow-up request to GET (303 always uses GET), whereas 307 and 308 preserve the original method and body. Use 307/308 to redirect a POST while keeping the method.

To send a client to a result page after a POST, use the 303 See Other + Location pattern (PRG, Post/Redirect/Get). Refreshing won't resubmit the form, preventing duplicate submissions.

On a 201 Created response, Location is not a redirect but the canonical URL of the created resource. The client can fetch the new resource at that URL.

Syntax

Location: <absolute-or-relative-URL>

e.g. Location: https://example.com/users/42

Notes

• Beware open-redirect vulnerabilities: placing unvalidated user input (e.g. ?next=) into Location lets attackers steer users to phishing sites. Defend with allowlists or by forcing relative paths.
• Location (redirect target) and Content-Location (actual location of the response body) are different headers — don't confuse them.
• Some old clients require absolute URLs. Relative URLs are allowed since RFC 7231, but using absolute URLs is safer for compatibility.

Related headers

Related status codes

Specification