Polish HTML structure of the response in the res.redirect() function by Bernice55231 · Pull Request #5167 · expressjs/express

Bernice55231 · 2023-04-16T05:56:24Z

Fixed #5058
To prevent the issue of not showing the DOM body in the old-versioned browser or HTTPServer in redirecting method, it is better to have the <!DOCTYPE html>' and <title>` elements in the response body. If we use an old-versioned browser, it may not automatically fulfill the correct HTML file and thus show only plain text on that page if it does not succeed in redirecting.

kevinsandow · 2023-04-19T10:36:56Z

Your changes look good to me, you just missed the tests for the redirect body in test/res.redirect.js.

Bernice55231 · 2023-04-19T18:15:52Z

Your changes look good to me, you just missed the tests for the redirect body in test/res.redirect.js.

Hi, I have updated the test file, could you review it again? Thank you!

kevinsandow · 2023-04-20T10:12:08Z

Looks good now, but I'm not the maintainer.

bjohansebas · 2025-03-19T01:41:29Z

Hi @Bernice55231, would you like to resolve the conflicts in this PR?

UlisesGascon · 2025-03-19T12:27:03Z

Keep in mind GHSA-qw6h-vgh9-j6wx when handling this conflict to prevent regressions :)

Copilot

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

lib/response.js:840

The string concatenation split into multiple lines may risk issues with automatic semicolon insertion in JavaScript; consider moving the '+' operator to the end of the preceding line to ensure the concatenation works as intended.

+ '<body><p>' + statuses.message[status] + '. Redirecting to ' + u + '</p></body>'

…rowser compatibility

bjohansebas · 2026-01-16T15:29:10Z

thanks @Bernice55231!

jonchurch

The change itself is fine, but wanted to leave context here for the future.

The justification for this PR is not accurate per the description nor the linked issue.

To be clear, no browser will fail to render the previous html.

The linked issue specifically wanted to allow the title to be seen in case the user's browser was blocking redirects, or if it launched an app and left the redirect page visible.

The title will now be "Found" for the default (302) which isnt much of an improvement over having the URL. But thats related to the issue not so much this PR.

However, since the PR leaves out the <html> tag, this still technically isnt valid HTML5.

But that does not matter, as browsers will render that for you.

bjohansebas · 2026-01-16T21:27:00Z

Good catch, I hadn’t realized that the HTML tag was still missing.

SaekiTominaga · 2026-01-17T01:38:38Z

Thank you for everyone's cooperation!

However, since the PR leaves out the tag, this still technically isnt valid HTML5.

html element can omit both start and end tags. Therefore, <!DOCTYPE html><head>...</head><body>...</body> is a valid HTML5 (or HTML Living Standard).

However, from an accessibility perspective, it is better to at least include the start tag and set the lang attribute, making it <!DOCTYPE html><html lang=en>....

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [express](https://expressjs.com/) ([source](https://github.com/expressjs/express)) | [`5.2.1` → `5.3.0`](https://renovatebot.com/diffs/npm/express/5.2.1/5.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/express/5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/5.2.1/5.3.0?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information. --- ### Release Notes <details> <summary>expressjs/express (express)</summary> ### [`v5.3.0`](https://github.com/expressjs/express/blob/HEAD/History.md#530) [Compare Source](expressjs/express@v5.2.1...v5.3.0) \===== #### 🐞 Bug fixes - Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by [@YuryShkoda](https://github.com/YuryShkoda) in [#4893](expressjs/express#4893) Fixed the behavior of `res.send()` to prevent conflicts between `Content-Length` and `Transfer-Encoding` HTTP headers in responses. The `Content-Length` header in `res.send()` is now only added when a `Transfer-Encoding` header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a `Transfer-Encoding` header - by [@cuishuang](https://github.com/cuishuang) in [#7459](expressjs/express#7459) * Upgrade `qs` to `^6.16.0`, which fixes [CVE-2026-2391](https://www.cve.org/CVERecord?id=CVE-2026-2391) ([GHSA-w7fw-mjwx-w883](GHSA-w7fw-mjwx-w883)), [CVE-2026-82417](https://www.cve.org/CVERecord?id=CVE-2026-82417) ([GHSA-4mjr-xmp4-gh2g](GHSA-4mjr-xmp4-gh2g)) and [CVE-2026-82562](https://www.cve.org/CVERecord?id=CVE-2026-82562) ([GHSA-x5fp-wj9c-mxmx](GHSA-x5fp-wj9c-mxmx)): `arrayLimit` bypasses in comma parsing and a denial of service via an attacker-controlled `isBuffer` - by [@davetashner](https://github.com/davetashner) in [#7057](expressjs/express#7057) and [#7478](expressjs/express#7478), and [@cyphercodes](https://github.com/cyphercodes) in [#7305](expressjs/express#7305) * Upgrade `proxy-addr` to `^2.0.8`, which fixes [CVE-2026-90711](https://www.cve.org/CVERecord?id=CVE-2026-90711) - by [@lazerg](https://github.com/lazerg) in [#7474](expressjs/express#7474) #### 🚀 Improvements - Allow conditional revalidation for QUERY requests. `req.fresh` previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by [@Cherry](https://github.com/Cherry) in [#7366](expressjs/express#7366) ```js // QUERY /reports with If-None-Match: "12345" app.query('/reports', (req, res) => { res.set('ETag', '"12345"'); res.send(results); // now responds 304 Not Modified }); ``` - Improve HTML structure in `res.redirect()` responses when HTML format is accepted by adding `<!DOCTYPE html>`, `<title>`, and `<body>` tags for better browser compatibility - by [@Bernice55231](https://github.com/Bernice55231) in [#5167](expressjs/express#5167) - When calling `app.render` with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by [AkaHarshit](https://github.com/AkaHarshit) in [#6903](expressjs/express#6903) ```js app.render('index', null, callback); // now works as expected ``` - Upgrade `content-type` to `^2.0.0`, bringing a faster parser (\~1.5x quicker `Content-Type` parsing/formatting in `res.send()`) along with a behavior change: `res.send()` now keeps any existing parameters when adding the charset and no longer throws on a `Content-Type` that fails to parse. `type-is` is upgraded to `^2.1.0` as part of the same change - by [@blakeembrey](https://github.com/blakeembrey) in [#7234](expressjs/express#7234) ```js res.set('Content-Type', 'text/plain; foo=bar').send('hey'); // -> Content-Type: text/plain; foo=bar; charset=utf-8 ``` - The default error handler now logs the full error object instead of only its stack trace, so nested details such as `Error.cause` and library-specific properties (e.g. Sequelize's `parent`/`original`) are no longer swallowed - by [@Nitin-Mohapatra](https://github.com/Nitin-Mohapatra) in [#6464](expressjs/express#6464) - Upgrade `content-disposition` to `^2.0.1`, which changes the `Content-Disposition` header emitted by `res.download()`, `res.attachment()`, and `res.sendFile()`: file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by [@blakeembrey](https://github.com/blakeembrey) in [#7233](expressjs/express#7233) ```js res.attachment('user.html'); // before -> Content-Disposition: attachment; filename="user.html" // after -> Content-Disposition: attachment; filename=user.html ``` - Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored - by [@Mayvis](https://github.com/Mayvis) in [#7390](expressjs/express#7390) #### ⚡ Performance - Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](expressjs/express#6991) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1812

bjohansebas added the 5.x label Mar 19, 2025

bjohansebas added the needs rebase label Mar 25, 2025

wesleytodd approved these changes Apr 11, 2025

View reviewed changes

Comment thread lib/response.js Outdated

Bernice55231 added 2 commits April 11, 2025 21:27

structure the DOM body

14e1403

structure the DOM body

937aa77

bjohansebas force-pushed the issue/5058 branch from 094ca63 to 6b309e3 Compare April 12, 2025 02:32

test: add html title to redirect test

6b309e3

bjohansebas requested review from ctcpip and wesleytodd April 12, 2025 02:42

bjohansebas removed the needs rebase label Apr 12, 2025

fix: update HTML structure for include body and head tags

6b16fc3

bjohansebas approved these changes Apr 12, 2025

View reviewed changes

bjohansebas requested a review from Copilot April 12, 2025 02:47

Copilot AI reviewed Apr 12, 2025

View reviewed changes

bjohansebas added the semver-minor This change is a semver minor label Jan 16, 2026

Merge branch 'master' of github.com:expressjs/express into issue/5058

bd63485

bjohansebas self-assigned this Jan 16, 2026

docs: improve HTML structure in res.redirect() responses for better b…

ac7fc4d

…rowser compatibility

bjohansebas merged commit 9a3f7ff into expressjs:master Jan 16, 2026
28 checks passed

jonchurch reviewed Jan 16, 2026

View reviewed changes

coderabbitai Bot mentioned this pull request Jul 28, 2026

chore: automated code quality fixes () saurabhhhcodes/CreatorOs#2

Open

UlisesGascon mentioned this pull request Sep 14, 2026

Release: 5.3.0 #7468

Merged

ved-merget mentioned this pull request Sep 18, 2026

[recall #5167] Polish HTML structure of the response in the res.redirect() function Pufferfish-Merget/recall-express#12

Merged

Navigation Menu

Repository navigation

Polish HTML structure of the response in the res.redirect() function - #5167

Polish HTML structure of the response in the res.redirect() function#5167
bjohansebas merged 6 commits into
expressjs:masterfrom
Bernice55231:issue/5058

Bernice55231 commented Apr 16, 2023 •

edited by bjohansebas

Loading

Uh oh!

kevinsandow commented Apr 19, 2023

Uh oh!

Bernice55231 commented Apr 19, 2023

Uh oh!

kevinsandow commented Apr 20, 2023

Uh oh!

bjohansebas commented Mar 19, 2025

Uh oh!

UlisesGascon commented Mar 19, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

bjohansebas commented Jan 16, 2026

Uh oh!

jonchurch left a comment

Uh oh!

bjohansebas commented Jan 16, 2026

Uh oh!

SaekiTominaga commented Jan 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

Bernice55231 commented Apr 16, 2023 • edited by bjohansebas Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kevinsandow commented Apr 19, 2023

Uh oh!

Bernice55231 commented Apr 19, 2023

Uh oh!

kevinsandow commented Apr 20, 2023

Uh oh!

bjohansebas commented Mar 19, 2025

Uh oh!

UlisesGascon commented Mar 19, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bjohansebas commented Jan 16, 2026

Uh oh!

jonchurch left a comment

Choose a reason for hiding this comment

Uh oh!

bjohansebas commented Jan 16, 2026

Uh oh!

SaekiTominaga commented Jan 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Bernice55231 commented Apr 16, 2023 •

edited by bjohansebas

Loading