{"record":{"id":"7ed6bed7831bf8fa","repo":"RocketChat/Rocket.Chat","slug":"invalid-url-format","errorCode":null,"errorMessage":"Invalid URL format","messagePattern":"Invalid URL format","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"apps/meteor/server/lib/saml/lib/SAML.ts","lineNumber":433,"sourceCode":"\t\t\tres.writeHead(500);\n\t\t\tres.end('SLO redirect not configured');\n\t\t\treturn;\n\t\t}\n\n\t\tif (!userRedirect || typeof userRedirect !== 'string') {\n\t\t\tres.writeHead(400);\n\t\t\tres.end('Missing redirect parameter');\n\t\t\treturn;\n\t\t}\n\n\t\tlet configuredURL: URL;\n\t\tlet requestURL: URL;\n\n\t\ttry {\n\t\t\tconfiguredURL = new URL(idpSLORedirectURL);\n\t\t\trequestURL = new URL(userRedirect);\n\t\t} catch {\n\t\t\tres.writeHead(400);\n\t\t\tres.end('Invalid URL format');\n\t\t\treturn;\n\t\t}\n\n\t\tif (configuredURL.origin !== requestURL.origin) {\n\t\t\tres.writeHead(403);\n\t\t\tres.end('Unauthorized redirect origin');\n\t\t\treturn;\n\t\t}\n\n\t\tconst normalizePath = (p: string): string => p.replace(/\\/+$/, '') || '/';\n\t\tif (normalizePath(configuredURL.pathname) !== normalizePath(requestURL.pathname)) {\n\t\t\tres.writeHead(403);\n\t\t\tres.end('Unauthorized redirect path');\n\t\t\treturn;\n\t\t}\n\n\t\tres.writeHead(302, {","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/2a7de457074cbb4d4373fbd9a4e5bea292c9c764/apps/meteor/server/lib/saml/lib/SAML.ts#L415-L451","documentation":"The SLO endpoint parses both the configured idpSLORedirectURL and the caller's `redirect` parameter with `new URL(value)` - no base URL is supplied, so relative values throw. If either fails to parse, the endpoint responds 400 'Invalid URL format'.","triggerScenarios":"Passing ?redirect=/home (a relative path - `new URL('/home')` throws without a base); passing a bare host like chat.example.com with no scheme; malformed percent-encoding in the query value; or the admin-configured idp_slo_redirect_url itself being a relative URL.","commonSituations":"Front-ends building the redirect from location.pathname instead of location.href; settings pasted without the https:// scheme; hand-edited SAML settings with stray characters.","solutions":["Pass a fully-qualified absolute URL including the scheme, e.g. https://chat.example.com/home","URL-encode the value when building the query string","If the error persists with a valid redirect parameter, fix the provider's idp_slo_redirect_url setting to an absolute URL"],"exampleFix":"// before\nconst redirect = window.location.pathname; // '/home' -> new URL() throws\n\n// after\nconst redirect = window.location.href; // 'https://chat.example.com/home'","handlingStrategy":"validation","validationCode":"const isAbsoluteUrl = (v: string): boolean => {\n  try {\n    new URL(v);\n    return true;\n  } catch {\n    return false;\n  }\n};","typeGuard":"const isAbsoluteUrl = (v: string): v is `${string}://${string}` => {\n  try {\n    new URL(v);\n    return true;\n  } catch {\n    return false;\n  }\n};","tryCatchPattern":null,"preventionTips":["Build redirect values from location.href, never location.pathname","Validate admin-entered URLs as absolute at settings-save time","URL-encode redirect values when placing them in query strings"],"tags":["saml","url-parsing","logout","http-400"],"backgroundTag":"invalid-url-format","analyzedSha":"2a7de457074cbb4d4373fbd9a4e5bea292c9c764","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}