{"record":{"id":"5ffb4df74f84f029","repo":"n8n-io/n8n","slug":"invalid-redirect-location-received-from-server","errorCode":null,"errorMessage":"Invalid redirect location received from server: ${location}","messagePattern":"Invalid redirect location received from server: (.+?)","errorType":"exception","errorClass":"OperationalError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/backend-network/src/http/axios/redirect.ts","lineNumber":210,"sourceCode":"\t\tthrow new AxiosError(\n\t\t\t`Request failed with status code ${response.status}`,\n\t\t\tcode,\n\t\t\tresponse.config,\n\t\t\tresponse.request,\n\t\t\tresponse,\n\t\t);\n\t}\n}\n\n/**\n * Resolves a redirect `Location` against the current URL.\n * @throws OperationalError when the server returns a malformed Location that cannot be resolved.\n */\nfunction resolveRedirectUrl(location: string, currentUrl: string): string {\n\ttry {\n\t\treturn new URL(location, currentUrl).href;\n\t} catch {\n\t\tthrow new OperationalError(`Invalid redirect location received from server: ${location}`);\n\t}\n}\n\n/**\n * Follows redirects manually, validating the target of every hop against the SSRF policy (DNS + IP),\n * so a redirect cannot reach a target the initial pre-flight check never saw,\n * including hostname targets carried by a proxy.\n */\nexport async function followSsrfRedirects(\n\tinitialConfig: AxiosRequestConfig,\n\tpolicy: SsrfRedirectPolicy,\n): Promise<AxiosResponse> {\n\tconst maxRedirects = initialConfig.maxRedirects ?? MAX_REDIRECTS_DEFAULT;\n\tconst originalUrl =\n\t\tbuildTargetUrl(initialConfig.url, initialConfig.baseURL) ?? initialConfig.url ?? '';\n\tconst baseValidateStatus =\n\t\tinitialConfig.validateStatus ?? ((status: number) => status >= 200 && status < 300);\n","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/backend-network/src/http/axios/redirect.ts#L192-L228","documentation":"OperationalError thrown by resolveRedirectUrl when `new URL(location, currentUrl)` throws — i.e. the server returned a redirect (3xx) with a Location header that is not a parseable URL. This is a server-side protocol violation; the redirect chain is aborted because there is no valid target to validate against the SSRF policy.","triggerScenarios":"A 3xx response in followSsrfRedirects carries a Location header that new URL() cannot parse (e.g. control characters, a missing scheme with no base resolution possible, or an entirely malformed value). resolveRedirectUrl catches and rethrows as OperationalError.","commonSituations":"Misconfigured upstream returns 'Location: //'; a server emits a relative path with no leading slash and no usable base; a security appliance injects a broken redirect; binary/garbage bytes leak into the header.","solutions":["Capture the exact Location header value (it is embedded in the message) and inspect it.","Treat the target endpoint as broken and surface a clear upstream error to the operator.","If you control the server, fix the redirect to emit an absolute or correctly-rooted URL.","Do not attempt to 'repair' the URL client-side — the SSRF policy cannot safely validate garbage."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-validate any Location you control before emitting it\nfunction isValidLocation(loc: string, base: string): boolean {\n  try { new URL(loc, base); return true; } catch { return false; }\n}","typeGuard":"import { OperationalError } from 'n8n-workflow';\nconst isInvalidRedirect = (e: unknown): boolean =>\n  e instanceof OperationalError && /Invalid redirect location/.test(e.message);","tryCatchPattern":"try {\n  const res = await followSsrfRedirects(config, policy);\n} catch (e) {\n  if (e instanceof OperationalError && /Invalid redirect location/.test(e.message)) {\n    // upstream is broken — do not retry the same URL; surface a clear error\n  }\n  throw e;\n}","preventionTips":["Do not try to repair malformed Location values client-side — SSRF policy cannot safely validate them.","Treat a malformed-redirect error as a server defect and alert the upstream owner.","Log the raw Location header for diagnosis when this fires."],"tags":["http","redirect","ssrf","url-parsing","backend-network"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}