Tesla.Middleware.FollowRedirects (tesla v1.21.3)

Follow HTTP 3xx redirects.

Examples

defmodule MyClient do
  def client do
  # defaults to 5
    Tesla.client([
      {Tesla.Middleware.FollowRedirects, max_redirects: 3}
    ])
  end
end

Options

• :max_redirects - limit number of redirects (default: 5)

Middleware order matters for credentials

On a redirect that crosses origins this middleware strips authorization, proxy-authorization, cookie and other origin-bound headers, so they are not sent to the new host. It can only strip headers that are already on the request when it runs, which means any middleware that sets credentials must be listed before Tesla.Middleware.FollowRedirects.

Middleware listed after it runs on every hop, including the redirected one, and re-adds its headers to a request this middleware has already filtered. A static credential set that way is sent to whatever host the location header names.

# Safe: the token is on the request before the redirect is followed, so it is
# stripped when the redirect crosses origins.
Tesla.client([
  {Tesla.Middleware.BearerAuth, token: token},
  Tesla.Middleware.FollowRedirects
])

# Unsafe: BearerAuth runs again on the redirected request and re-adds the
# token after the stripping has happened.
Tesla.client([
  Tesla.Middleware.FollowRedirects,
  {Tesla.Middleware.BearerAuth, token: token}
])

The same applies to Tesla.Middleware.BasicAuth, Tesla.Middleware.DigestAuth and to a Tesla.Middleware.Headers carrying a static credential.