{"record":{"id":"1d05dd3fdb2600a3","repo":"musistudio/claude-code-router","slug":"origin-redirected-to-loadedorigin","errorCode":null,"errorMessage":"Origin redirected to ${loadedOrigin}.","messagePattern":"Origin redirected to (.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/electron/src/main/chrome-login-import.ts","lineNumber":371,"sourceCode":"    height: 480,\n    paintWhenInitiallyHidden: true,\n    show: false,\n    skipTaskbar: true,\n    title: \"CCR Chrome Login Import\",\n    webPreferences: {\n      contextIsolation: true,\n      nodeIntegration: false,\n      partition,\n      sandbox: true,\n      webSecurity: true\n    },\n    width: 640\n  });\n  try {\n    await withTimeout(window.webContents.loadURL(`${origin}/`), localStorageWriteTimeoutMs, \"Timed out loading localStorage origin.\");\n    const loadedOrigin = new URL(window.webContents.getURL()).origin;\n    if (loadedOrigin !== origin) {\n      throw new Error(`Origin redirected to ${loadedOrigin}.`);\n    }\n    const entries = Object.entries(items);\n    await window.webContents.executeJavaScript(\n      `(() => {\n        const entries = ${JSON.stringify(entries)};\n        for (const [key, value] of entries) {\n          window.localStorage.setItem(key, value);\n        }\n        return entries.length;\n      })()`,\n      true\n    );\n  } finally {\n    if (!window.isDestroyed()) {\n      window.destroy();\n    }\n  }\n}","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/electron/src/main/chrome-login-import.ts#L353-L389","documentation":"Thrown when a hidden BrowserWindow loaded for localStorage import ends up on a different origin than requested (e.g. the site redirects HTTP->HTTPS or to a canonical domain). The import writes localStorage entries via executeJavaScript on the loaded origin, so a redirect would silently write credentials into the wrong origin's storage and the guard aborts.","triggerScenarios":"Calling the Chrome login import with a localStorage item whose origin is e.g. http://example.com but which 301-redirects to https://www.example.com; loadURL succeeds but getURL().origin differs from the requested origin.","commonSituations":"Imported Chrome localStorage entries recorded under http:// or apex domains while the live site enforces HTTPS/WWW redirects; typos in the origin string; sites that redirect to a login/locale subdomain.","solutions":["Re-export the login state from Chrome while browsing the exact final origin (scheme + host + www) and re-import","Normalize/upgrade origins in the payload to the final redirect target before importing","If the redirect is expected and trusted, pre-resolve the origin (follow the redirect once yourself) and rewrite the payload's origin field"],"exampleFix":"// before\nlocalStorage: [{ origin: \"http://example.com\", items: {...} }]\n\n// after\nlocalStorage: [{ origin: \"https://www.example.com\", items: {...} }]","handlingStrategy":"validation","validationCode":"import { looksLikeHttpUrl } from './url.js';\n\nfunction assertStableOrigin(origin: string): void {\n  if (!looksLikeHttpUrl(origin)) throw new Error(`Invalid origin: ${origin}`);\n  const res = await fetch(origin, { method: 'HEAD', redirect: 'manual' });\n  if (res.status >= 300 && res.status < 400) {\n    throw new Error(`Origin ${origin} redirects to ${res.headers.get('location')}`);\n  }\n}","typeGuard":"function isHttpOrigin(value: string): boolean {\n  try { const u = new URL(value); return u.protocol === 'http:' || u.protocol === 'https:'; }\n  catch { return false; }\n}","tryCatchPattern":"try {\n  await importLoginState(payload);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Origin redirected to ')) {\n    const target = err.message.slice('Origin redirected to '.length).replace(/\\.$/, '');\n    payload.localStorage.forEach(i => i.origin = target);\n    await importLoginState(payload); // retry once with final origin\n  } else throw err;\n}","preventionTips":["Export login state while on the exact final HTTPS origin","Normalize origins (upgrade http->https, add www) before import","Catch the redirect error and retry once with the reported target origin"],"tags":["electron","localstorage","redirect","origin","login-import"],"backgroundTag":"url-redirect-origin-mismatch","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}