{"record":{"id":"63f5e33c2e9f43a1","repo":"puppetlabs/puppet","slug":"location-response-header-is-missing","errorCode":null,"errorMessage":"Location response header is missing","messagePattern":"Location response header is missing","errorType":"exception","errorClass":"Puppet::HTTP::ProtocolError","httpStatus":null,"severity":"error","filePath":"lib/puppet/http/redirector.rb","lineNumber":81,"sourceCode":"      new_request[header] = value\n    end\n\n    # mimic private Net::HTTP#addr_port\n    new_request['Host'] = if (location.scheme == 'https' && location.port == 443) ||\n                             (location.scheme == 'http' && location.port == 80)\n                            location.host\n                          else\n                            \"#{location.host}:#{location.port}\"\n                          end\n\n    new_request\n  end\n\n  private\n\n  def parse_location(response)\n    location = response['location']\n    raise Puppet::HTTP::ProtocolError, _(\"Location response header is missing\") unless location\n\n    URI.parse(location)\n  rescue URI::InvalidURIError => e\n    raise Puppet::HTTP::ProtocolError.new(_(\"Location URI is invalid: %{detail}\") % { detail: e.message }, e)\n  end\nend\n","sourceCodeStart":63,"sourceCodeEnd":88,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/http/redirector.rb#L63-L88","documentation":"After a 301/302/307, Puppet::HTTP::Redirector#parse_location reads the Location response header to build the next request. RFC-compliant redirects must include it; when the header is absent the redirect cannot continue and Puppet::HTTP::ProtocolError is raised.","triggerScenarios":"A server or intermediary returns 301/302/307 without a Location header (redirect_to is only called for those codes); auth portals or proxies emitting status 302 with an HTML body but no header; header stripped by a middlebox.","commonSituations":"Custom endpoints or misconfigured nginx/haproxy rules using 'return 302' without a URL; application servers that signal redirects via body meta-refresh; security appliances rewriting responses.","solutions":["Inspect the raw response (curl -i) and fix the server/proxy to send 'Location: <absolute-or-relative-url>'.","If the endpoint should not redirect at all, correct the route returning the 3xx.","Point the client at the final URL so no redirect is involved."],"exampleFix":"# nginx - before\nlocation /puppet {\n  return 302;\n}\n\n# after\nlocation /puppet {\n  return 302 https://puppet.internal:8140/puppet;\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  client.get(uri)\nrescue Puppet::HTTP::ProtocolError => e\n  raise unless e.message.include?('Location response header is missing')\n  # inspect the 3xx manually and decide: follow the real URL or fail loudly\n  raise\nend","preventionTips":["Proxy/server rules for redirects must always emit a Location header.","Smoke-test endpoints with curl -i to catch malformed 3xx responses early."],"tags":["puppet","http","redirect","protocol","headers"],"backgroundTag":"invalid-redirect-response","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}