307 redirect
A 307 is a temporary redirect that preserves the request method and body. A POST stays a POST at the new URL. Chrome also displays '307 Internal Redirect' when HSTS upgrades HTTP to HTTPS; this is a browser-side response, not from any server.
Why it matters
The internal 307 is one of the most misread lines in DevTools. Developers hunt their server config for a redirect that doesn't exist. Recognising "307 Internal Redirect" as the browser's own HSTS (or preload-list) upgrade saves that hunt. For server-sent 307s, method preservation makes them the correct temporary redirect for anything accepting POST bodies: APIs, webhooks, form handlers.
How it works
A server-sent 307 response includes a Location header. The browser makes a new request to that URL, preserving the original method and body. If the original was POST with JSON, the follow-up is also POST with the same JSON.
Chrome generates a synthetic "307 Internal Redirect" when the browser's HSTS store or preload list upgrades HTTP to HTTPS. This happens before any network request, entirely inside the browser. It has no real response headers; DevTools marks it with a Non-Authoritative-Reason tag.
RFC 9110 requires clients to preserve the method and body when following a 307. A 302, by contrast, permits changing the method.
What doesn't matter
A 307 in a navigation chain for HTML pages is unusual. Most page moves use 301 or 302. If you see one in a normal redirect chain, it may signal a framework defaulting to method preservation, which is correct but uncommon.
The internal 307 from HSTS doesn't indicate an error. It's normal and expected; it's a sign your HSTS policy is working. Don't try to suppress it or change it in server config.
Code example
A 307 preserves the request method when redirecting.
curl -sI -X POST https://api.example.com/v1/endpoint
HTTP/1.1 307 Temporary Redirect
Location: https://api.example.com/v2/endpoint
The browser follows with the same method:
POST /v2/endpoint
Compare this to a 302, which permits method changes:
curl -sI -X POST https://api.example.com/v1/endpoint
HTTP/1.1 302 Found
Location: https://api.example.com/v2/endpoint
Many clients convert POST to GET on 302:
GET /v2/endpoint
In DevTools, a 307 Internal Redirect from HSTS appears like this:
Request URL: http://example.com
Status Code: 307 Internal Redirect
Non-Authoritative-Reason: HSTS
How Scalpel shows it
A server-sent 307 hop shows its status line on the connector and counts toward the hop total. A "307 Internal Redirect" from HSTS pairs with an HSTS hint chip, making it clear the browser, not the server, issued the upgrade.