RocketChat/Rocket.Chat · warning

Unauthorized redirect path

Error message

Unauthorized redirect path

What it means

Second anti-open-redirect check in the SAML SLO endpoint: once origins match, the redirect target's path must also equal the configured SLO path (trailing slashes normalized via replace(/\/+$/, '') || '/'). A different path on the same host gets 403 'Unauthorized redirect path'.

Source

Thrown at apps/meteor/server/lib/saml/lib/SAML.ts:446

		try {
			configuredURL = new URL(idpSLORedirectURL);
			requestURL = new URL(userRedirect);
		} catch {
			res.writeHead(400);
			res.end('Invalid URL format');
			return;
		}

		if (configuredURL.origin !== requestURL.origin) {
			res.writeHead(403);
			res.end('Unauthorized redirect origin');
			return;
		}

		const normalizePath = (p: string): string => p.replace(/\/+$/, '') || '/';
		if (normalizePath(configuredURL.pathname) !== normalizePath(requestURL.pathname)) {
			res.writeHead(403);
			res.end('Unauthorized redirect path');
			return;
		}

		res.writeHead(302, {
			Location: requestURL.toString(),
		});

		res.end();
	}

	private static async processAuthorizeAction(
		req: IIncomingMessage,
		res: ServerResponse,
		service: IServiceProviderOptions,
		samlObject: ISAMLAction,
	): Promise<void> {
		const serviceProvider = new SAMLServiceProvider(service);

View on GitHub (pinned to 2a7de45707)

Solutions

1. Use exactly the configured path (trailing slashes are ignored) - derive the redirect from the configured URL
2. Change the provider's idp_slo_redirect_url to the path you want; it is the only redirect target this endpoint accepts
3. Note the comparison uses pathname only: query strings may differ, paths may not

// Reuse the configured SLO URL verbatim; vary only the query string, never the path
const sloTarget = (configured: string, query?: Record<string, string>): string => {
  const u = new URL(configured);
  if (query) for (const [k, v] of Object.entries(query)) u.searchParams.set(k, v);
  return u.toString();
};

When it happens

Trigger: ?redirect=https://chat.example.com/some/other/path when idp_slo_redirect_url is https://chat.example.com/slo; extra path segments; a deep link to /home or /login while the setting points at the IdP's SLO path.

Common situations: Wanting to land users on the home screen after logout while the configured SLO path is different; the setting changed to a new path but clients still redirect to old locations; copy-pasted redirect targets differing by one segment.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unauthorized redirect origin
• SLO redirect not configured
• Missing redirect parameter
• Invalid URL format
• An assertion with the same ID cannot be used more than once.

AI-assisted analysis of RocketChat/Rocket.Chat@2a7de45707 (2026-08-18). Data as JSON: /api/errors/171ae98e95457093. Report an issue: GitHub.