RocketChat/Rocket.Chat · warning

Missing redirect parameter

Error message

Missing redirect parameter

What it means

The SAML SLO redirect endpoint requires a `redirect` query parameter (the post-logout destination). The official client sends it as `?redirect=<encoded absolute URL>` (apps/meteor/client/meteor/login/saml.ts:80). When the parameter is absent or not a single string, the endpoint responds 400 'Missing redirect parameter'.

Source

Thrown at apps/meteor/server/lib/saml/lib/SAML.ts:421

					Location: Meteor.absoluteUrl(),
				});
				res.end();
			}
		});
	}

	private static processSLORedirectAction(req: IIncomingMessage, res: ServerResponse, service: IServiceProviderOptions): void {
		const { idpSLORedirectURL } = service;
		const userRedirect = req.query.redirect as string;

		if (!idpSLORedirectURL) {
			res.writeHead(500);
			res.end('SLO redirect not configured');
			return;
		}

		if (!userRedirect || typeof userRedirect !== 'string') {
			res.writeHead(400);
			res.end('Missing redirect parameter');
			return;
		}

		let configuredURL: URL;
		let requestURL: URL;

		try {
			configuredURL = new URL(idpSLORedirectURL);
			requestURL = new URL(userRedirect);
		} catch {
			res.writeHead(400);
			res.end('Invalid URL format');
			return;
		}

		if (configuredURL.origin !== requestURL.origin) {
			res.writeHead(403);

View on GitHub (pinned to 2a7de45707)

Solutions

1. Append the required parameter, URL-encoded: `/_saml/sloRedirect/<provider>/?redirect=${encodeURIComponent('https://chat.example.com/')}`
2. Send exactly one `redirect` parameter - repeated values can arrive as an array and fail the string check
3. If a proxy rewrites the URL, make sure it preserves the query string

Example fix

// before
window.location.href = absoluteUrl(`_saml/sloRedirect/${provider}/`);

// after
window.location.replace(absoluteUrl(`_saml/sloRedirect/${provider}/?redirect=${encodeURIComponent(result)}`));

const sloUrl = (provider: string, redirect: string) =>
  `/_saml/sloRedirect/${encodeURIComponent(provider)}/?redirect=${encodeURIComponent(redirect)}`;

const hasRedirectParam = (u: string): boolean => new URL(u, location.origin).searchParams.has('redirect');

When it happens

Trigger: Calling `/_saml/sloRedirect/<provider>/` with no query string; sending `?redirect=` with an empty value; sending the destination under a different parameter name (e.g. ?returnTo=); duplicating the parameter so it parses as an array.

Common situations: Custom logout buttons or bookmarks hitting the SLO endpoint directly; code written against an older flow that did not require the parameter; proxies or rewrites stripping the query string.

Related errors

• Invalid URL format
• SLO redirect not configured
• Unauthorized redirect origin
• Unauthorized redirect path
• registration-disabled-authentication-services

AI-assisted analysis of RocketChat/Rocket.Chat@2a7de45707 (2026-08-18). Data as JSON: /api/errors/a48fbeb15b1888f1. Report an issue: GitHub.