Posted over 5 years ago. Visible to the public. Repeats.

Redirecting responses for PATCH or DELETE will not redirect with GET

Redirect responses to PATCH and DELETE requests will be followed with PATCH or DELETE. Redirect responses to GET and POST will be followed with a GET.
The Rails form_for helper will use a workaround to send POST requests with a _method param to avoid this issue for PATCH/DELETE.

If you make requests yourself, watch out for the following behavior.

When you make an AJAX request PATCH /foo and the /foo action redirects to /bar, browsers will request PATCH /bar. You probably expected the second request to be GET /bar, since we're used to redirects always resulting in a GET request.

# Browser sends PATCH /foo HTTP/1.1 # Server responds HTTP/1.1 302 Found Location: /bar # Browser follows redirect PATCH /bar # Server responds HTTP/1.1 404 Not Found

This is also true on some browsers for DELETE, or in general for any AJAX call that is neither GET or POST.

Some workarounds for this issue below.

Fix on the server: Redirect with a 303 status code

If your redirecting action redirects with a HTTP status code of 303 See Other the browser will always follow up with a GET request, even if the requesting method is PATCH or DELETE:

def foo redirect_to '/bar', status: :see_other end

Fix on the client: Make a POST request with method override

The default configuration Rails and Sinatra includes a Rack middleware Archive that lets you control the HTTP method used for routing by POSTing with a _method param.

In jQuery this would be:

$.ajax('/foo', { type: 'POST', data: { _method: 'PATCH' } });

Since the request is now a POST for the browser, it will follow a redirect with GET as expected.

This is also what Unpoly Archive or the Rails unobtrusive Javascript adapter does when you annotate a link with data-method="PATCH".

Does your version of Ruby on Rails still receive security updates?
Rails LTS provides security patches for old versions of Ruby on Rails (3.2 and 2.3).

Owner of this card:

Henning Koch
Last edit:
10 months ago
by Henning Koch
About this deck:
We are makandra and do test-driven, agile Ruby on Rails software development.
License for source code
Posted by Henning Koch to makandra dev
This website uses short-lived cookies to improve usability.
Accept or learn more