SonarSource/sonarqube · error · GitlabServerException

Request was redirected, please provide the correct URL

Error message

Request was redirected, please provide the correct URL

What it means

If the OkHttp response is a redirect, checkResponseIsSuccessful throws GitlabServerException 'Request was redirected, please provide the correct URL'. OkHttp normally follows redirects transparently, so a visible redirect means the call landed somewhere that demanded authentication (e.g. an SSO/login page) — the configured GitLab URL is not the direct API endpoint.

Source

Thrown at server/sonar-alm-client/src/main/java/org/sonar/alm/client/gitlab/GitlabApplicationClient.java:224

  protected static void checkResponseIsSuccessful(Response response, String errorMessage) throws IOException {
    if (!response.isSuccessful()) {
      String body = response.body().string();
      LOG.error("Gitlab API call to [{}] failed with {} http code. gitlab response content : [{}]", response.request().url(), response.code(), body);
      if (isTokenRevoked(response, body)) {
        throw new GitlabServerException(response.code(), "Your GitLab token was revoked");
      } else if (isTokenExpired(response, body)) {
        throw new GitlabServerException(response.code(), "Your GitLab token is expired");
      } else if (isInsufficientScope(response, body)) {
        throw new GitlabServerException(response.code(), "Your GitLab token has insufficient scope");
      } else if (response.code() == HTTP_FORBIDDEN) {
        throw new GitlabServerException(response.code(), "Forbidden access to GitLab. Verify your token's permissions and IP restrictions.");
      } else if (response.code() == HTTP_TOO_MANY_REQUESTS) {
        throw new GitlabServerException(response.code(), "GitLab API rate limit exceeded. Try again later.");
      } else if (response.code() == HTTP_UNAUTHORIZED) {
        throw new GitlabServerException(response.code(), "Invalid personal access token");
      } else if (response.isRedirect()) {
        throw new GitlabServerException(response.code(), "Request was redirected, please provide the correct URL");
      } else {
        throw new GitlabServerException(response.code(), errorMessage);
      }
    }
  }

  private static boolean isTokenRevoked(Response response, String body) {
    if (response.code() == HTTP_UNAUTHORIZED) {
      try {
        Optional<GsonError> gitlabError = GsonError.parseOne(body);
        return gitlabError.map(GsonError::getErrorDescription).map(description -> description.contains("Token was revoked")).orElse(false);
      } catch (JsonParseException e) {
        // nothing to do
      }
    }
    return false;
  }

View on GitHub (pinned to 184c821202)

Solutions

  1. Set the GitLab URL to the instance root without login paths (e.g. https://gitlab.example.com, not https://gitlab.example.com/users/sign_in).
  2. Use https:// directly if http:// is being redirected.
  3. If an SSO proxy fronts GitLab, ensure API paths bypass SSO redirects or use an allow-listed route for the SonarQube server.
  4. Check with curl -IL whether the configured URL issues a redirect before calling the API.

Example fix

// before
gitlab.url = https://gitlab.example.com/users/sign_in
// after
gitlab.url = https://gitlab.example.com
Defensive patterns

Strategy: validation

Validate before calling

// Reject redirecting URLs before configuring the integration
HttpURLConnection c = (HttpURLConnection) new URL(gitlabUrl + "/api/v4/version").openConnection();
c.setInstanceFollowRedirects(false);
if (c.getResponseCode() >= 300 && c.getResponseCode() < 400) {
  throw new IllegalStateException("GitLab URL redirects to " + c.getHeaderField("Location") + " — use the direct instance root URL");
}

Prevention

When it happens

Trigger: Any GitLab API call via checkResponseIsSuccessful receives a 3xx redirect response (response.isRedirect()) at GitlabApplicationClient.java:224 — typically when the base URL points at a login/SSO page or a redirecting gateway.

Common situations: GitLab URL configured with /users/sign_in path; http:// URL redirected to https:// by the server; SSO/IDP portal in front of GitLab redirecting unauthenticated API calls; load balancer redirecting to a different host.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/e21a7b654653166e. Report an issue: GitHub.