Which redirect does CloudFront use when a viewer requests HTTP?

Definition: CloudFront's Viewer Protocol Policy determines how a cache behavior handles an HTTP request. With Redirect HTTP to HTTPS, GET and HEAD receive a 301 redirect, selected methods receive a 307 redirect when the request uses HTTP 1.1 or above, and those selected methods receive 403 when the request uses an older protocol.

Key facts

• Amazon CloudFront's viewer HTTPS documentation says that GET and HEAD requests are redirected to HTTPS with status 301, Moved Permanently.
• CloudFront uses status 307, Temporary Redirect, for POST, PUT, DELETE, OPTIONS, and PATCH sent over HTTP when the cache behavior uses HTTP 1.1 or above.
• CloudFront documents that the 307 response sends those methods and their body payload to the new HTTPS location again.
• For those same methods with a request protocol below HTTP 1.1, CloudFront returns 403, Forbidden.
• The HTTP Semantics specification defines 307 as a redirect where an automatically redirected request keeps its method.

What does Redirect HTTP to HTTPS return?

The Viewer Protocol Policy is a cache behavior setting. With Redirect HTTP to HTTPS, viewers can use both HTTP and HTTPS. CloudFront automatically redirects HTTP GET and HEAD requests, returns 301 with the new HTTPS URL, and the viewer resubmits the request to that URL.

For a request that carries a method and body that CloudFront lists explicitly, the result depends on the request protocol version. POST, PUT, DELETE, OPTIONS, and PATCH over HTTP with HTTP 1.1 or above receive 307. The new location is HTTPS, and CloudFront sends the request again with the same method and body payload.

HTTP/1.1 301 Moved Permanently
Location: <new HTTPS URL>

HTTP/1.1 307 Temporary Redirect
Location: <new HTTPS URL>

Why is 307 used for these methods?

RFC 9110 defines 301 as a permanent URI change and says that a user agent may use the Location field for automatic redirection. Its historical note allows a user agent to change POST to GET after a 301 response.

The same specification defines 307 as a temporary move and requires a user agent to keep the request method when it automatically redirects. That rule matches CloudFront's documented handling for the listed methods because the method and body payload need to reach the HTTPS location together.

What happens with older HTTP protocol versions?

CloudFront documents a separate outcome for POST, PUT, DELETE, OPTIONS, and PATCH sent over HTTP when the request protocol is below HTTP 1.1: it returns 403, Forbidden. There is no HTTP to HTTPS redirect for that case.

The policy also has an HTTPS only option. Under that option, viewers can access content only through HTTPS. An HTTP request receives 403 and CloudFront does not return the object. The page also states that a request redirected from HTTP to HTTPS incurs charges for both requests.

How can you check the response?

Send each method to the same CloudFront path over HTTP and record the status code and Location response header. Test the body-carrying methods with an HTTP 1.1 request, then compare the result with the older protocol case if that client is part of your compatibility scope. The documented outcomes to look for are 301 for GET and HEAD, 307 for the listed methods with HTTP 1.1 or above, and 403 for those methods below HTTP 1.1.

Related terms

• HTTP redirects
• How do I move a website from HTTP to HTTPS for Google Search?
• Why does Vercel use method-preserving redirect status codes?

FAQ

Does CloudFront always return 301 for an HTTP request?

No. Under Redirect HTTP to HTTPS, CloudFront documents 301 for GET and HEAD. It documents 307 for the listed methods with HTTP 1.1 or above, and 403 for those methods below HTTP 1.1.

Does a CloudFront 307 change POST into GET?

CloudFront documents that the request is sent again with the same method and body payload. RFC 9110 defines 307 as a status where an automatic redirect keeps the request method.

What does HTTPS only do?

It returns 403 for an HTTP request and does not return the object. The request is not redirected to an HTTPS URL under that policy.

Sources

1. Amazon Web Services, "Require HTTPS for communication between viewers and CloudFront", undated
2. IETF, "RFC 9110: HTTP Semantics", June 2022

---

Check how a page reads to answer engines. Open the GEO score analyzer