# `Tesla.Middleware.FollowRedirects`
[🔗](https://github.com/elixir-tesla/tesla/blob/v1.21.3/lib/tesla/middleware/follow_redirects.ex#L1)

Follow HTTP 3xx redirects.

## Examples

```elixir
defmodule MyClient do
  def client do
  # defaults to 5
    Tesla.client([
      {Tesla.Middleware.FollowRedirects, max_redirects: 3}
    ])
  end
end
```

## Options

- `:max_redirects` - limit number of redirects (default: `5`)

## Middleware order matters for credentials

On a redirect that crosses origins this middleware strips `authorization`,
`proxy-authorization`, `cookie` and other origin-bound headers, so they are not
sent to the new host. It can only strip headers that are already on the request
when it runs, which means **any middleware that sets credentials must be listed
before `Tesla.Middleware.FollowRedirects`.**

Middleware listed after it runs on every hop, including the redirected one, and
re-adds its headers to a request this middleware has already filtered. A static
credential set that way is sent to whatever host the `location` header names.

```elixir
# Safe: the token is on the request before the redirect is followed, so it is
# stripped when the redirect crosses origins.
Tesla.client([
  {Tesla.Middleware.BearerAuth, token: token},
  Tesla.Middleware.FollowRedirects
])

# Unsafe: BearerAuth runs again on the redirected request and re-adds the
# token after the stripping has happened.
Tesla.client([
  Tesla.Middleware.FollowRedirects,
  {Tesla.Middleware.BearerAuth, token: token}
])
```

The same applies to `Tesla.Middleware.BasicAuth`, `Tesla.Middleware.DigestAuth`
and to a `Tesla.Middleware.Headers` carrying a static credential.

---

*Consult [api-reference.md](api-reference.md) for complete listing*