From 3adb7d5b5b57759c726b8d96b3e23f356ad36c13 Mon Sep 17 00:00:00 2001
From: Romain Lanz <romain.lanz@pm.me>
Date: Wed, 23 Sep 2026 11:52:46 +0000
Subject: [PATCH] fix(response): honor explicit query string forwarding
 overrides

---
 src/response.ts        |  6 ++---
 tests/redirect.spec.ts | 52 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/src/response.ts b/src/response.ts
index 053b8af..2201dfb 100644
--- a/src/response.ts
+++ b/src/response.ts
@@ -1035,14 +1035,14 @@ export class HttpResponse extends Macroable {
   redirect(path: string, forwardQueryString?: boolean, statusCode?: number): void
   redirect(
     path?: string,
-    forwardQueryString: boolean = false,
+    forwardQueryString?: boolean,
     statusCode: number = ResponseStatus.Found
   ): Redirect | void {
     const handler = new Redirect(this.request, this, this.#router, this.#qs, this.#config.redirect)
     handler.ctx = this.ctx
 
-    if (forwardQueryString) {
-      handler.withQs()
+    if (forwardQueryString !== undefined) {
+      handler.withQs(forwardQueryString)
     }
 
     if (path === 'back') {
diff --git a/tests/redirect.spec.ts b/tests/redirect.spec.ts
index 7d81576..1857197 100644
--- a/tests/redirect.spec.ts
+++ b/tests/redirect.spec.ts
@@ -45,6 +45,58 @@ test.group('Redirect', () => {
     assert.equal(header.location, '/foo?username=romain')
   })
 
+  test('redirect to given url without overriding global query string forwarding', async ({
+    assert,
+  }) => {
+    const { url } = await httpServer.create((req, res) => {
+      const response = new HttpResponseFactory()
+        .merge({
+          req,
+          res,
+          encryption,
+          router,
+          config: {
+            redirect: {
+              allowedHosts: [],
+              forwardQueryString: true,
+            },
+          },
+        })
+        .create()
+
+      response.redirect('/foo')
+      response.finish()
+    })
+
+    const { header } = await supertest(url).get('/?username=romain').redirects(1)
+    assert.equal(header.location, '/foo?username=romain')
+  })
+
+  test('redirect to given url can disable global query string forwarding', async ({ assert }) => {
+    const { url } = await httpServer.create((req, res) => {
+      const response = new HttpResponseFactory()
+        .merge({
+          req,
+          res,
+          encryption,
+          router,
+          config: {
+            redirect: {
+              allowedHosts: [],
+              forwardQueryString: true,
+            },
+          },
+        })
+        .create()
+
+      response.redirect('/foo', false)
+      response.finish()
+    })
+
+    const { header } = await supertest(url).get('/?username=romain').redirects(1)
+    assert.equal(header.location, '/foo')
+  })
+
   test('redirect to given url and forward current query string', async ({ assert }) => {
     const { url } = await httpServer.create((req, res) => {
       const response = new HttpResponseFactory().merge({ req, res, encryption, router }).create()