Subject: Should the HTTP Method change when following a 303 redirect ?

From: "Pof Magicfingers (Giovanni Olivera)" <[email-masked]>
Date: Wed, 22 Apr 2020 12:41:23 +0200

Hi everyone,

I'm reaching out to you to clarify what behavior is expected regarding a
303 redirect.

I'm currently discussing about this with the cURL team, and we're not
really sure if a user agent SHOULD or MAY change the HTTP method to GET or
HEAD when following a 303 redirect.
You can read the discussion here : https://github.com/curl/curl/issues/5237

Reading RFC7231 at section-6.4.4
<https://tools.ietf.org/html/rfc7231#section-6.4.4>, it states that :

> A user agent can perform a retrieval request targeting that URI (a GET or
HEAD  request if using HTTP)
> [...]
> This status code is applicable to any HTTP method.
But it seems unclear if the user agent SHOULD use a GET method when
following the redirect,  regardless of the current method used, for a 303
redirect, of it should keep the current method used for the request
inducing that redirect.

Could you help us determine what behavior should be followed in such case ?

Thanks !

Best Regards,
Giovanni «Pof Magicfingers» Olivera

---

From: Amos Jeffries <[email-masked]>
Date: Thu, 23 Apr 2020 01:34:04 +1200

On 22/04/20 10:41 pm, Pof Magicfingers (Giovanni Olivera) wrote:
> really sure if a user agent SHOULD or MAY change the HTTP method to GET
> or HEAD when following a 303 redirect. 
>> A user agent can perform a retrieval request targeting that URI (a GET
> or HEAD  request if using HTTP)
>> [...]
> following the redirect,  regardless of the current method used, for a
> 303 redirect, of it should keep the current method used for the request
> inducing that redirect.

The Location URL in a 303 is defined for _retrieval_. Only retrieval
methods can be expected to work on it.

HTTP defined GET and HEAD for regular use, but other protocols may
define more methods for retrieval. So there is no requirement to use
GET/HEAD specifically. Those other protocol alternatives may be used if
the context needs one.

Amos

---

From: "Pof Magicfingers (Giovanni Olivera)" <[email-masked]>
Date: Wed, 22 Apr 2020 16:21:14 +0200

If I understand this correctly, except for specific protocols defining
other rules, by default, a standard http user agent should use a GET or
HEAD method when following the Location header for 303, as they're the
regular retrieval method ?

Thanks for the clarification !
Pof