# Location Header — Syntax, Values & Examples

> The URL to go to next — the target of a redirect, or the address of a newly created resource.

With a 3xx status, Location is where the client should go next; browsers follow it automatically. With [201 Created](https://www.devkult.com/http/201.md), it points at the resource that was just created. Relative URLs are allowed and resolve against the request URL.

- Type: Response header
- Category: Routing & context
- Defined in: [RFC 9110 §10.2.2 — Location](https://www.rfc-editor.org/rfc/rfc9110.html#section-10.2.2)

## Syntax

```http
Location: <url>
```

## Examples

```http
Location: https://www.example.com/new-path
```

an absolute redirect target

```http
Location: /login?next=%2Fdashboard
```

a relative URL, resolved against the request

```http
Location: /api/orders/1234
```

with 201 Created: the new resource

## Good to know

- Use [301](https://www.devkult.com/http/301.md) or [308](https://www.devkult.com/http/308.md) for permanent moves, [302](https://www.devkult.com/http/302.md) or [307](https://www.devkult.com/http/307.md) for temporary ones. 307 and 308 keep the method and body.
- Never redirect to a URL taken straight from user input — validate it against an allowlist to avoid open redirects.
- fetch follows redirects silently; check `res.redirected` and `res.url` to see where you ended up.

## How to set Location

### Express

```
res.redirect(301, "https://www.example.com/new-path");
```

### Next.js (next.config.js)

```
module.exports = {
  async redirects() {
    return [
      { source: "/old-path", destination: "/new-path", permanent: true }, // 308
    ];
  },
};
```

### Next.js (server code)

```
import { redirect, permanentRedirect } from "next/navigation";

redirect("/login");          // 307
permanentRedirect("/new-path"); // 308
```

### nginx

```
location = /old-path {
  return 301 https://www.example.com/new-path;
}
```

### Apache (.htaccess)

```
Redirect 301 /old-path https://www.example.com/new-path
```

## Check it

Fetch only the response headers and filter for Location. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^location:'
```

## FAQ

### Can Location be a relative URL?

Yes. Since RFC 7231, relative references are allowed and resolved against the request URL, and every browser supports them.

### Why does my redirect loop?

The target redirects back — often HTTP↔HTTPS or www↔apex rules fighting, or a proxy that terminates TLS so the app thinks every request is plain HTTP. Trace it with curl -sIL.

## Status codes it appears with

- [201 Created](https://www.devkult.com/http/201.md)
- [301 Moved Permanently](https://www.devkult.com/http/301.md)
- [302 Found](https://www.devkult.com/http/302.md)
- [303 See Other](https://www.devkult.com/http/303.md)
- [307 Temporary Redirect](https://www.devkult.com/http/307.md)
- [308 Permanent Redirect](https://www.devkult.com/http/308.md)

## Related headers

- [Retry-After](https://www.devkult.com/headers/retry-after.md): How long the client should wait before retrying — sent with 429, 503 and some redirects.
- [Host](https://www.devkult.com/headers/host.md): The domain name (and port) the request is for, so one server can host many sites.
- [Referer](https://www.devkult.com/headers/referer.md): The address of the page that linked to or loaded the requested resource.

## Further reading

- [301 vs 302 vs 307 vs 308](https://www.devkult.com/blog/301-vs-302-vs-307-vs-308.md)
- [HTTP status checker](https://www.devkult.com/tools/web/http-status-checker.md)
- [Fixing ERR_TOO_MANY_REDIRECTS](https://www.devkult.com/blog/err-too-many-redirects.md)

Open the interactive page: https://www.devkult.com/headers/location