Fix HTTPFacilitatorClient not following 308 redirects

typescript/.changeset/fix-facilitator-redirect.md

@@ -0,0 +1,5 @@
+---
+'@x402/core': patch
+---
+
+Fixed HTTPFacilitatorClient not following 308 redirects from facilitator endpoints. Normalized base URL to strip trailing slashes and explicitly set `redirect: "follow"` on all fetch calls for cross-runtime compatibility.

typescript/packages/core/src/http/httpFacilitatorClient.ts

@@ -191,7 +191,9 @@ export class HTTPFacilitatorClient implements FacilitatorClient {
    * @param config - Configuration options for the facilitator client
    */
   constructor(config?: FacilitatorConfig) {
-    this.url = config?.url || DEFAULT_FACILITATOR_URL;
+    // Normalize URL: strip trailing slashes to prevent redirect loops (e.g. 308)
+    // when constructing endpoint paths like `${url}/supported`
+    this.url = (config?.url || DEFAULT_FACILITATOR_URL).replace(/\/+$/, "");
     this._createAuthHeaders = config?.createAuthHeaders;
   }
 
@@ -218,6 +220,7 @@ export class HTTPFacilitatorClient implements FacilitatorClient {
     const response = await fetch(`${this.url}/verify`, {
       method: "POST",
       headers,
+      redirect: "follow",
       body: JSON.stringify({
         x402Version: paymentPayload.x402Version,
         paymentPayload: this.toJsonSafe(paymentPayload),
@@ -269,6 +272,7 @@ export class HTTPFacilitatorClient implements FacilitatorClient {
     const response = await fetch(`${this.url}/settle`, {
       method: "POST",
       headers,
+      redirect: "follow",
       body: JSON.stringify({
         x402Version: paymentPayload.x402Version,
         paymentPayload: this.toJsonSafe(paymentPayload),
@@ -318,6 +322,7 @@ export class HTTPFacilitatorClient implements FacilitatorClient {
       const response = await fetch(`${this.url}/supported`, {
         method: "GET",
         headers,
+        redirect: "follow",
       });
 
       if (response.ok) {

typescript/packages/core/test/unit/http/httpFacilitatorClient.test.ts

@@ -163,4 +163,105 @@ describe("HTTPFacilitatorClient", () => {
     expect(result.errorMessage).toBeUndefined();
     expect(result.payer).toBeUndefined();
   });
+
+  describe("URL normalization", () => {
+    it("strips trailing slashes from the configured URL", () => {
+      const client = new HTTPFacilitatorClient({ url: "https://x402.org/facilitator/" });
+      expect(client.url).toBe("https://x402.org/facilitator");
+    });
+
+    it("strips multiple trailing slashes", () => {
+      const client = new HTTPFacilitatorClient({ url: "https://x402.org/facilitator///" });
+      expect(client.url).toBe("https://x402.org/facilitator");
+    });
+
+    it("leaves URLs without trailing slash unchanged", () => {
+      const client = new HTTPFacilitatorClient({ url: "https://x402.org/facilitator" });
+      expect(client.url).toBe("https://x402.org/facilitator");
+    });
+
+    it("uses default URL when no config is provided", () => {
+      const client = new HTTPFacilitatorClient();
+      expect(client.url).toBe("https://x402.org/facilitator");
+    });
+  });
+
+  describe("redirect handling", () => {
+    it("passes redirect: follow to fetch on getSupported", async () => {
+      const mockFetch = vi.fn().mockResolvedValue(
+        new Response(
+          JSON.stringify({
+            kinds: [{ x402Version: 2, scheme: "exact", network: "eip155:8453" }],
+          }),
+          { status: 200 },
+        ),
+      );
+      vi.stubGlobal("fetch", mockFetch);
+
+      const client = new HTTPFacilitatorClient({ url: "https://facilitator.test" });
+      await client.getSupported();
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "https://facilitator.test/supported",
+        expect.objectContaining({ redirect: "follow" }),
+      );
+    });
+
+    it("passes redirect: follow to fetch on verify", async () => {
+      const mockFetch = vi
+        .fn()
+        .mockResolvedValue(new Response(JSON.stringify({ isValid: true }), { status: 200 }));
+      vi.stubGlobal("fetch", mockFetch);
+
+      const client = new HTTPFacilitatorClient({ url: "https://facilitator.test" });
+      await client.verify(paymentPayload, paymentRequirements);
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "https://facilitator.test/verify",
+        expect.objectContaining({ redirect: "follow" }),
+      );
+    });
+
+    it("passes redirect: follow to fetch on settle", async () => {
+      const mockFetch = vi.fn().mockResolvedValue(
+        new Response(
+          JSON.stringify({
+            success: true,
+            transaction: "0xabc",
+            network: "eip155:8453",
+          }),
+          { status: 200 },
+        ),
+      );
+      vi.stubGlobal("fetch", mockFetch);
+
+      const client = new HTTPFacilitatorClient({ url: "https://facilitator.test" });
+      await client.settle(paymentPayload, paymentRequirements);
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "https://facilitator.test/settle",
+        expect.objectContaining({ redirect: "follow" }),
+      );
+    });
+
+    it("constructs correct endpoint URLs after trailing slash normalization", async () => {
+      const mockFetch = vi.fn().mockResolvedValue(
+        new Response(
+          JSON.stringify({
+            kinds: [{ x402Version: 2, scheme: "exact", network: "eip155:8453" }],
+          }),
+          { status: 200 },
+        ),
+      );
+      vi.stubGlobal("fetch", mockFetch);
+
+      const client = new HTTPFacilitatorClient({ url: "https://x402.org/facilitator/" });
+      await client.getSupported();
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "https://x402.org/facilitator/supported",
+        expect.anything(),
+      );
+    });
+  });
 });