Budibase/budibase · error

Redirects are not permitted.

Error message

Redirects are not permitted.

What it means

fetchWithBlacklist performs manual redirect handling. When the server responds with a 3xx status and the caller passed followRedirects: false, the library throws instead of following, because silently following redirects would bypass the caller's security intent.

Source

Thrown at packages/backend-core/src/utils/outboundFetch.ts:224

      )
    } catch (error) {
      const hostname = parseUrl(nextUrl).hostname
      if (error instanceof Error) {
        error.message = `Failed to connect to resolved IP for ${hostname}: ${error.message}`
        throw error
      }
      throw new Error(
        `Failed to connect to resolved IP for ${hostname}: unknown network error`
      )
    }
    if (!isRedirect(response.status)) {
      return response
    }

    releaseResponseBody(response)

    if (!followRedirects) {
      throw new Error("Redirects are not permitted.")
    }

    if (redirects === MAX_REDIRECTS) {
      break
    }

    const location = response.headers.get("location")
    if (!location) {
      if (returnRedirectWithoutLocation) {
        return response
      }
      throw new Error("Maximum redirect reached.")
    }

    const redirectUrl = parseUrl(
      new URL(location, nextUrl).toString()
    ).toString()
    nextRequest = nextRequestForRedirect(nextRequest, response.status)

View on GitHub (pinned to a81a902e9a)

Solutions

1. Pass { followRedirects: true } (or omit the option) if following redirects is acceptable.
2. Use the final, non-redirecting URL directly (follow the redirect once manually and store the canonical URL).
3. Check the response manually by using returnRedirectWithoutLocation/inspect the 3xx status before configuring strict no-follow behavior.

Example fix

// before
await fetchWithBlacklist(url, {}, { followRedirects: false })
// after
await fetchWithBlacklist(url, {}, { followRedirects: true })

// Resolve the URL to a non-redirecting endpoint first, or declare redirect intent explicitly
const res = await fetchWithBlacklist(url, {}, { followRedirects: false })
if ([301,302,303,307,308].includes(res.status)) {
  throw new Error(`Endpoint redirects (${res.status}); use its final URL`)
}

try {
  return await fetchWithBlacklist(url, req, { followRedirects: false })
} catch (err) {
  if (err instanceof Error && err.message === "Redirects are not permitted.") {
    // fall back to a redirect-following call or report a misconfigured endpoint
    return fetchWithBlacklist(url, req, { followRedirects: true })
  }
  throw err
}

When it happens

Trigger: Calling fetchWithBlacklist with { followRedirects: false } (default is true) while the target URL returns 301/302/303/307/308 — e.g. http→https upgrades, trailing-slash redirects, or auth-driven redirects.

Common situations: Fetching an http:// URL that 301-redirects to https:// while redirects are disabled; APIs that redirect to a canonical domain; short-link services that always redirect.

Related errors

• Maximum redirect reached.
• Redirect to a different origin is not permitted.
• Failed to download asset: ${response.statusText}
• Failed to fetch file from URL: ${response.statusText}
• Failed to fetch file from URL: ${fallbackResponse.statusText

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/2e1d49b260c67783. Report an issue: GitHub.