expressjs.com/_includes/api/en/5x/res-location.md

res.location(path)

Sets the response Location HTTP header to the specified path parameter.

res.location('/foo/bar')
res.location('http://example.com')

After encoding the URL, if not encoded already, Express passes the specified URL to the browser in the `Location` header, without any validation.

Browsers take the responsibility of deriving the intended URL from the current URL or the referring URL, and the URL specified in the Location header; and redirect the user accordingly.