Budibase/budibase · error

Redirect to a different origin is not permitted.

Error message

Redirect to a different origin is not permitted.

What it means

When a redirect crosses origins (current URL origin differs from the redirect target's origin) and the caller set rejectCrossOriginRedirects: true, the library throws instead of following. This protects credentials and prevents redirects being used to smuggle requests to unintended hosts.

Solutions

1. Use the final destination URL directly so no cross-origin redirect occurs.
2. Drop rejectCrossOriginRedirects (leave default false) if the cross-origin hop is trusted — sensitive headers will then be stripped automatically.
3. If authentication is involved, perform the auth flow against the target origin rather than following redirects with credentials.

Example fix

// before
await fetchWithBlacklist("https://example.com/data", req, { rejectCrossOriginRedirects: true })
// after (server 301s to www.example.com)
await fetchWithBlacklist("https://www.example.com/data", req, { rejectCrossOriginRedirects: true })

// Resolve redirects manually and assert same-origin before the guarded call
let current = url
for (let i = 0; i < 5; i++) {
  const res = await fetchWithBlacklist(current, { followRedirects: false })
  if (![301,302,303,307,308].includes(res.status)) break
  const loc = res.headers.get("location")
  if (!loc) break
  const next = new URL(loc, current)
  if (next.origin !== new URL(current).origin) {
    throw new Error(`Cross-origin redirect to ${next.origin} not allowed`)
  }
  current = next.toString()
}

try {
  return await fetchWithBlacklist(url, req, { rejectCrossOriginRedirects: true })
} catch (err) {
  if (err instanceof Error && err.message.includes("different origin")) {
    throw new Error("Endpoint redirects off-origin; use its final URL directly")
  }
  throw err
}

When it happens

Trigger: fetchWithBlacklist called with { rejectCrossOriginRedirects: true } and the server redirects to a different origin — e.g. api.example.com → auth.example.com/login, or http → https on a different host.

Common situations: SSO/login flows redirecting to another domain; CDN or apex↔www redirects (example.com → www.example.com); environment config pointing at a host that 301s to its canonical domain.

Related errors

• Maximum redirect reached.
• Redirects are not permitted.
• App not found
• Cannot reset password.
• Color is invalid.

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/a73bd3c59b3a3a0a. Report an issue: GitHub.

Appendix: source

Thrown at packages/backend-core/src/utils/outboundFetch.ts:245

    if (redirects === MAX_REDIRECTS) {
      break
    }

    const location = response.headers.get("location")
    if (!location) {
      if (returnRedirectWithoutLocation) {
        return response
      }
      throw new Error("Maximum redirect reached.")
    }

    const redirectUrl = parseUrl(
      new URL(location, nextUrl).toString()
    ).toString()
    nextRequest = nextRequestForRedirect(nextRequest, response.status)
    if (shouldStripSensitiveHeadersForRedirect(nextUrl, redirectUrl)) {
      if (rejectCrossOriginRedirects) {
        throw new Error("Redirect to a different origin is not permitted.")
      }
      nextRequest = stripSensitiveHeadersForRedirect(nextRequest)
    }
    nextUrl = redirectUrl
  }

  throw new Error("Maximum redirect reached.")
}

View on GitHub (pinned to a81a902e9a)