RocketChat/Rocket.Chat · warning

Unauthorized redirect origin

Error message

Unauthorized redirect origin

What it means

Anti-open-redirect protection in the SAML SLO endpoint: after parsing, the `redirect` target's origin (scheme + host + port) must exactly equal the origin of the configured idpSLORedirectURL. On any mismatch the endpoint responds 403 'Unauthorized redirect origin'.

Source

Thrown at apps/meteor/server/lib/saml/lib/SAML.ts:439

			res.writeHead(400);
			res.end('Missing redirect parameter');
			return;
		}

		let configuredURL: URL;
		let requestURL: URL;

		try {
			configuredURL = new URL(idpSLORedirectURL);
			requestURL = new URL(userRedirect);
		} catch {
			res.writeHead(400);
			res.end('Invalid URL format');
			return;
		}

		if (configuredURL.origin !== requestURL.origin) {
			res.writeHead(403);
			res.end('Unauthorized redirect origin');
			return;
		}

		const normalizePath = (p: string): string => p.replace(/\/+$/, '') || '/';
		if (normalizePath(configuredURL.pathname) !== normalizePath(requestURL.pathname)) {
			res.writeHead(403);
			res.end('Unauthorized redirect path');
			return;
		}

		res.writeHead(302, {
			Location: requestURL.toString(),
		});

		res.end();
	}

View on GitHub (pinned to 2a7de45707)

Solutions

1. Use a redirect URL whose scheme, host and port exactly match the configured idp_slo_redirect_url
2. Update the provider's idp_slo_redirect_url setting to the origin you actually want users to land on after logout
3. Do not attempt cross-domain post-logout redirects - this endpoint only ever returns to the configured origin

// Build the redirect target from the configured SLO URL so origins always match
const buildSloRedirect = (configuredSloUrl: string, path = '/'): string => {
  const base = new URL(configuredSloUrl);
  return new URL(path, base).toString();
};

When it happens

Trigger: ?redirect=https://other-host.example.com/... while the provider's SLO URL points at chat.example.com; scheme mismatch (http vs https); port mismatch (example.com vs example.com:8443); subdomain mismatch (www.example.com vs example.com).

Common situations: Workspace served on a different domain than the configured SLO URL; domain migrations without updating SAML settings; attempts to send users to a status page or external portal after logout; test environments using a different host than the production config.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized redirect path
• SLO redirect not configured
• Missing redirect parameter
• Invalid URL format
• An assertion with the same ID cannot be used more than once.

AI-assisted analysis of RocketChat/Rocket.Chat@2a7de45707 (2026-08-18). Data as JSON: /api/errors/dbf889ad5019ab93. Report an issue: GitHub.