RocketChat/Rocket.Chat · warning

Invalid URL format

Error message

Invalid URL format

What it means

The SLO endpoint parses both the configured idpSLORedirectURL and the caller's `redirect` parameter with `new URL(value)` - no base URL is supplied, so relative values throw. If either fails to parse, the endpoint responds 400 'Invalid URL format'.

Source

Thrown at apps/meteor/server/lib/saml/lib/SAML.ts:433

			res.writeHead(500);
			res.end('SLO redirect not configured');
			return;
		}

		if (!userRedirect || typeof userRedirect !== 'string') {
			res.writeHead(400);
			res.end('Missing redirect parameter');
			return;
		}

		let configuredURL: URL;
		let requestURL: URL;

		try {
			configuredURL = new URL(idpSLORedirectURL);
			requestURL = new URL(userRedirect);
		} catch {
			res.writeHead(400);
			res.end('Invalid URL format');
			return;
		}

		if (configuredURL.origin !== requestURL.origin) {
			res.writeHead(403);
			res.end('Unauthorized redirect origin');
			return;
		}

		const normalizePath = (p: string): string => p.replace(/\/+$/, '') || '/';
		if (normalizePath(configuredURL.pathname) !== normalizePath(requestURL.pathname)) {
			res.writeHead(403);
			res.end('Unauthorized redirect path');
			return;
		}

		res.writeHead(302, {

View on GitHub (pinned to 2a7de45707)

Solutions

1. Pass a fully-qualified absolute URL including the scheme, e.g. https://chat.example.com/home
2. URL-encode the value when building the query string
3. If the error persists with a valid redirect parameter, fix the provider's idp_slo_redirect_url setting to an absolute URL

Example fix

// before
const redirect = window.location.pathname; // '/home' -> new URL() throws

// after
const redirect = window.location.href; // 'https://chat.example.com/home'

const isAbsoluteUrl = (v: string): boolean => {
  try {
    new URL(v);
    return true;
  } catch {
    return false;
  }
};

const isAbsoluteUrl = (v: string): v is `${string}://${string}` => {
  try {
    new URL(v);
    return true;
  } catch {
    return false;
  }
};

When it happens

Trigger: Passing ?redirect=/home (a relative path - `new URL('/home')` throws without a base); passing a bare host like chat.example.com with no scheme; malformed percent-encoding in the query value; or the admin-configured idp_slo_redirect_url itself being a relative URL.

Common situations: Front-ends building the redirect from location.pathname instead of location.href; settings pasted without the https:// scheme; hand-edited SAML settings with stray characters.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Missing redirect parameter
• SLO redirect not configured
• Unauthorized redirect origin
• Unauthorized redirect path
• registration-disabled-authentication-services

AI-assisted analysis of RocketChat/Rocket.Chat@2a7de45707 (2026-08-18). Data as JSON: /api/errors/7ed6bed7831bf8fa. Report an issue: GitHub.