apache/superset · error

Invalid URL scheme

Error message

Invalid URL scheme

What it means

Error "Invalid URL scheme" thrown in apache/superset.

Source

Thrown at superset/views/redirect.py:69

    route_base = "/redirect"

    @expose("/")
    def redirect_warning(self) -> FlaskResponse:
        """Validate the target URL and either redirect or show the warning page."""
        if not is_feature_enabled("ALERT_REPORTS"):
            abort(404)

        target_url = request.args.get("url", "").strip()

        if not target_url:
            abort(400, description="Missing URL parameter")

        # Block dangerous schemes using urlparse for robust detection
        parsed = urlparse(target_url)
        if parsed.scheme.lower() in DANGEROUS_SCHEMES:
            logger.warning("Blocked dangerous URL scheme: %s", target_url[:80])
            abort(400, description="Invalid URL scheme")

        # Internal URLs redirect immediately
        if is_safe_redirect_url(target_url):
            return redirect(target_url)

        # External URLs: render the React warning page
        return super().render_app_template()

View on GitHub (pinned to f4587218dd)

Solutions

1. Use an http/https URL; other schemes are rejected by the redirect endpoint.

When it happens

Trigger: The redirect endpoint receives a URL with a disallowed scheme.

Common situations: Hitting the redirect endpoint with a URL using a disallowed scheme (only http/https permitted).

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/e6ee0a83743dbafa. Report an issue: GitHub.