Redirects

REST Assured follows redirects for you. So if /login answers with a 302 that points to /dashboard, this test sees the dashboard, not the redirect:

get("/login").then().statusCode(200); // the response from /dashboard

Most of the time that’s what you want. This page is for the times it isn’t.

Default behaviour

By default REST Assured only follows redirects of GET and HEAD requests. That covers the status codes 301, 302, 307 and 308. A 303 See Other is the exception: it’s always followed, whatever the method, and the next request is a GET.

With forms this matters. A POST that answers with 302 is not followed, so you get the 302 back:

post("/login").then().statusCode(302).header("Location", "/dashboard");

If you’d rather have REST Assured follow redirects of POST, PUT, DELETE and the rest too (since REST Assured 6.3.0):

RestAssured.config = RestAssured.config().redirect(redirectConfig().followRedirectsForAllMethods(true));

What the next request looks like depends on the status code. A 307 or 308 sends the same method and the same body again. Any other redirect turns the request into a GET without a body, which is what browsers do.

Not following redirects

Sometimes the redirect is the thing you want to test, for example that an old URL points to the new one. Turn off following for that request and check the status code and the Location header:

given().
        redirects().follow(false).
when().
        get("/old-page").
then().
        statusCode(301).
        header("Location", endsWith("/new-page"));

To turn it off for every request:

RestAssured.config = RestAssured.config().redirect(redirectConfig().followRedirects(false));

Circular redirects and max redirects

REST Assured stops a redirect loop for you. If a redirect leads back to a URL the request has already been to, the request fails with a java.net.ProtocolException:

Circular redirect to 'http://localhost:8080/loop'

If your service really does redirect back to the same URL, for example while it waits for a job to finish, allow it and set a limit:

given().redirects().allowCircular(true).redirects().max(5). ..

The limit is 100 redirects by default. Go past it and the request fails with a TooManyRedirectsException:

Maximum redirects (5) exceeded

Relative redirects

A Location header such as dashboard or ../dashboard, without a scheme and host, is resolved against the URL of the request, the same way a browser does it. If you want your test to fail when your service sends a relative Location, reject them:

given().redirects().rejectRelative(true). ..

and the request fails with Relative redirect location 'dashboard' not allowed.

Cross-host redirects

When a redirect leads to another host, REST Assured drops the Authorization and Cookie headers before it follows it, so your password or session doesn’t leak to a host you didn’t send it to. “Another host” means the scheme, the host or the port is different from the request you started with. So http://localhost:8080 to http://127.0.0.1:8080 counts, and so does http to https. The Proxy-Authorization header is kept, since it’s for the proxy and not for the host.

If you do want the headers sent to the other host too, for example because your test setup redirects between two hosts that you own:

RestAssured.config = RestAssured.config()
        .redirect(redirectConfig().stripSensitiveHeadersOnCrossHostRedirect(false));

Cookies and redirects

A response that redirects can set cookies, typically a session cookie after a login. By default REST Assured doesn’t send those cookies along when it follows the redirect. To keep them:

RestAssured.config = RestAssured.config().httpClient(httpClientConfig().keepResponseCookies(true));

For keeping a session across several requests of your own, see Sessions.

Redirect settings

The redirects() DSL sets them for one request:

given().
        redirects().follow(true).
        redirects().max(12).
        redirects().allowCircular(false).
        redirects().rejectRelative(false). ..

RedirectConfig sets them for all requests, or for a specification:

RestAssured.config = RestAssured.config().redirect(redirectConfig()
        .followRedirects(true)
        .maxRedirects(12)
        .allowCircularRedirects(false)
        .rejectRelativeRedirect(false)
        .followRedirectsForAllMethods(false)
        .stripSensitiveHeadersOnCrossHostRedirect(true));

The values above are the defaults, except maxRedirects, which is 100.