[PR #759] [MERGED] fix: validate redirect status codes in NextResponse.redirect() #823

New issue

Closed

opened 2026-05-06 13:10:18 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:18 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/759
Author: @NathanDrake2406
Created: 4/3/2026
Status: ✅ Merged
Merged: 4/3/2026
Merged by: @james-elicx

Base: main ← Head: fix/redirect-status-validation

📝 Commits (1)

67f1223 fix: validate redirect status codes in NextResponse.redirect()

📊 Changes

2 files changed (+31 additions, -0 deletions)

View changed files

📝 packages/vinext/src/shims/server.ts (+6 -0)
📝 tests/shims.test.ts (+25 -0)

📄 Description

Summary

NextResponse.redirect() accepted any status code without validation
redirect(url, 200) silently created a non-redirect response — browser won't follow Location header on non-3xx status
Now throws RangeError for invalid redirect status codes (anything not 301/302/303/307/308), matching Next.js behavior

Test plan

Test: redirect(url, 200) throws RangeError
Test: redirect(url, 418) throws RangeError
Test: error message matches Next.js format
Test: redirect(url, 303) succeeds (was missing coverage)
Test: redirect(url, 307) defaults correctly (existing, regression)
Existing server shim tests pass (17/17)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/759 **Author:** [@NathanDrake2406](https://github.com/NathanDrake2406) **Created:** 4/3/2026 **Status:** ✅ Merged **Merged:** 4/3/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/redirect-status-validation` --- ### 📝 Commits (1) - [`67f1223`](https://github.com/cloudflare/vinext/commit/67f1223009ef0fd7239f32633832183f223a2914) fix: validate redirect status codes in NextResponse.redirect() ### 📊 Changes **2 files changed** (+31 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/shims/server.ts` (+6 -0) 📝 `tests/shims.test.ts` (+25 -0) </details> ### 📄 Description ## Summary - `NextResponse.redirect()` accepted any status code without validation - `redirect(url, 200)` silently created a non-redirect response — browser won't follow Location header on non-3xx status - Now throws `RangeError` for invalid redirect status codes (anything not 301/302/303/307/308), matching Next.js behavior ## Test plan - [x] Test: `redirect(url, 200)` throws RangeError - [x] Test: `redirect(url, 418)` throws RangeError - [x] Test: error message matches Next.js format - [x] Test: `redirect(url, 303)` succeeds (was missing coverage) - [x] Test: `redirect(url, 307)` defaults correctly (existing, regression) - [x] Existing server shim tests pass (17/17) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>