{"record":{"id":"82603fcdf829e915","repo":"sveltejs/kit","slug":"redirect-options-external-must-be-true-or-an-a","errorCode":null,"errorMessage":"`redirect` options.external must be `true` or an array of allowed origins (prod: 'Invalid redirect options.external value')","messagePattern":"`redirect` options\\.external must be `true` or an array of allowed origins \\(prod: 'Invalid redirect options\\.external value'\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/exports/url.js","lineNumber":81,"sourceCode":"\t\t\t);\n\t\t}\n\n\t\treturn;\n\t}\n\n\tif (Array.isArray(external)) {\n\t\tif (!external.some((allowed) => matches_external_allowlist_entry(location, allowed))) {\n\t\t\tthrow new Error(\n\t\t\t\tDEV\n\t\t\t\t\t? `Cannot redirect to ${JSON.stringify(location)}: URL origin is not included in the \\`external\\` allowlist`\n\t\t\t\t\t: 'Cannot redirect to external URL unless explicitly allowed'\n\t\t\t);\n\t\t}\n\n\t\treturn;\n\t}\n\n\tthrow new Error(\n\t\tDEV\n\t\t\t? '`redirect` options.external must be `true` or an array of allowed origins'\n\t\t\t: 'Invalid redirect options.external value'\n\t);\n}\n","sourceCodeStart":63,"sourceCodeEnd":87,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/exports/url.js#L63-L87","documentation":"The `external` option of `redirect()` accepts only `true` (allow any external URL) or an array of allowed origin strings/patterns. Any other value (number, object, string, false, null) fails validation and throws, with a generic production message.","triggerScenarios":"Passing `redirect(302, url, { external: 'https://example.com' })` (a bare string instead of an array), `{ external: false }`, `{ external: 1 }`, or forgetting the option shape entirely.","commonSituations":"Misreading the docs and passing a single origin string instead of wrapping it in an array; dynamically computing `external` from env config that ends up empty/undefined; older code written against a different API shape.","solutions":["Wrap a single origin in an array: `external: ['https://example.com']`","Use `external: true` if all external URLs should be allowed","Remove the option if you only redirect to same-origin relative URLs","Check where the value is generated — an undefined/empty config value often becomes an invalid type"],"exampleFix":"// before\nredirect(302, url, { external: 'https://example.com' });\n// after\nredirect(302, url, { external: ['https://example.com'] });","handlingStrategy":"validation","validationCode":"const ext = options.external;\nif (ext !== undefined && ext !== true && !(Array.isArray(ext) && ext.every((e) => typeof e === 'string'))) {\n  throw new TypeError('external must be true or an array of origin strings');\n}","typeGuard":"function isValidExternalOption(v) {\n  return v === true || (Array.isArray(v) && v.every((e) => typeof e === 'string'));\n}","tryCatchPattern":"try {\n  redirect(status, location, { external });\n} catch (err) {\n  if (/Invalid redirect options.external/.test(err.message)) {\n    console.error('external option must be true or string[]; got', typeof external);\n  }\n  throw err;\n}","preventionTips":["Always wrap single origins in an array: external: ['https://x.com']","Type the options in TS so invalid shapes fail at compile time","Centralize redirect calls in a helper that validates options once"],"tags":["redirect","validation","api-misuse"],"backgroundTag":"invalid-enum-value","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}