Budibase/budibase · error

Redirect to a different origin is not permitted.

Error message

Redirect to a different origin is not permitted.

What it means

When a redirect crosses origins (current URL origin differs from the redirect target's origin) and the caller set rejectCrossOriginRedirects: true, the library throws instead of following. This protects credentials and prevents redirects being used to smuggle requests to unintended hosts.

Source

Thrown at packages/backend-core/src/utils/outboundFetch.ts:245

    if (redirects === MAX_REDIRECTS) {
      break
    }

    const location = response.headers.get("location")
    if (!location) {
      if (returnRedirectWithoutLocation) {
        return response
      }
      throw new Error("Maximum redirect reached.")
    }

    const redirectUrl = parseUrl(
      new URL(location, nextUrl).toString()
    ).toString()
    nextRequest = nextRequestForRedirect(nextRequest, response.status)
    if (shouldStripSensitiveHeadersForRedirect(nextUrl, redirectUrl)) {
      if (rejectCrossOriginRedirects) {
        throw new Error("Redirect to a different origin is not permitted.")
      }
      nextRequest = stripSensitiveHeadersForRedirect(nextRequest)
    }
    nextUrl = redirectUrl
  }

  throw new Error("Maximum redirect reached.")
}

View on GitHub (pinned to a81a902e9a)

Solutions

1. Use the final destination URL directly so no cross-origin redirect occurs.
2. Drop rejectCrossOriginRedirects (leave default false) if the cross-origin hop is trusted — sensitive headers will then be stripped automatically.
3. If authentication is involved, perform the auth flow against the target origin rather than following redirects with credentials.

Example fix

// before
await fetchWithBlacklist("https://example.com/data", req, { rejectCrossOriginRedirects: true })
// after (server 301s to www.example.com)
await fetchWithBlacklist("https://www.example.com/data", req, { rejectCrossOriginRedirects: true })

// Resolve redirects manually and assert same-origin before the guarded call
let current = url
for (let i = 0; i < 5; i++) {
  const res = await fetchWithBlacklist(current, { followRedirects: false })
  if (![301,302,303,307,308].includes(res.status)) break
  const loc = res.headers.get("location")
  if (!loc) break
  const next = new URL(loc, current)
  if (next.origin !== new URL(current).origin) {
    throw new Error(`Cross-origin redirect to ${next.origin} not allowed`)
  }
  current = next.toString()
}

try {
  return await fetchWithBlacklist(url, req, { rejectCrossOriginRedirects: true })
} catch (err) {
  if (err instanceof Error && err.message.includes("different origin")) {
    throw new Error("Endpoint redirects off-origin; use its final URL directly")
  }
  throw err
}

When it happens

Trigger: fetchWithBlacklist called with { rejectCrossOriginRedirects: true } and the server redirects to a different origin — e.g. api.example.com → auth.example.com/login, or http → https on a different host.

Common situations: SSO/login flows redirecting to another domain; CDN or apex↔www redirects (example.com → www.example.com); environment config pointing at a host that 301s to its canonical domain.

Related errors

• Redirects are not permitted.
• Maximum redirect reached.
• OIDC Config contents invalid
• Koa context must be supplied to logout.
• Unexpected header format

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/a73bd3c59b3a3a0a. Report an issue: GitHub.