{"record":{"id":"f80f73d9ef068df3","repo":"sveltejs/kit","slug":"invalid-redirect-location-json-stringify-locatio","errorCode":null,"errorMessage":"Invalid redirect location ${JSON.stringify(location)}: this string contains characters that cannot be used in HTTP headers","messagePattern":"Invalid redirect location (.+?): this string contains characters that cannot be used in HTTP headers","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/exports/internal/shared.js","lineNumber":35,"sourceCode":"/**\n * An `HttpError` whose body is already in its final, user-facing form — either produced by the\n * `handleError` hook on the server and reconstructed here from the response, or authored directly\n * by the client runtime. Unlike a plain `HttpError` (which represents a fresh `error(...)` call\n * that the hook has yet to see), `handleError` must not run on it.\n * @extends HttpError\n */\nexport class HandledHttpError extends HttpError {}\n\nexport class Redirect {\n\t/**\n\t * @param {300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308} status\n\t * @param {string} location\n\t */\n\tconstructor(status, location) {\n\t\ttry {\n\t\t\tnew Headers({ location });\n\t\t} catch {\n\t\t\tthrow new Error(\n\t\t\t\t`Invalid redirect location ${JSON.stringify(location)}: ` +\n\t\t\t\t\t'this string contains characters that cannot be used in HTTP headers'\n\t\t\t);\n\t\t}\n\n\t\tthis.status = status;\n\t\tthis.location = location;\n\t}\n}\n\n/**\n * An error that was thrown from within the SvelteKit runtime that is not fatal and doesn't result in a 500, such as a 404.\n * `SvelteKitError` goes through `handleError`.\n * @extends Error\n */\nexport class SvelteKitError extends Error {\n\t/**\n\t * @param {number} status","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/exports/internal/shared.js#L17-L53","documentation":"The `Redirect` class validates that the `location` string can be safely placed in a `Location` HTTP header. If `new Headers({ location })` throws — e.g. the string contains newlines, control characters, or other invalid header characters — the redirect is rejected rather than risking header injection or malformed responses.","triggerScenarios":"Calling `redirect(302, userInput)` where the input contains `\\n`, `\\r`, or other non-printable/control characters; building a location from decoded data with embedded newlines.","commonSituations":"Redirecting to a URL taken verbatim from a query parameter or form field that contains encoded line breaks; log-parsing or copy-paste artifacts introducing newlines into the target URL (a classic open-redirect/header-injection vector).","solutions":["Sanitize the location before redirecting: trim whitespace and strip or reject control characters (`/[\\u0000-\\u001F\\u007F]/`).","Validate the target against an allowlist of paths or origins before calling `redirect`.","Use `encodeURI`/`encodeURIComponent` for user-derived path segments.","If the input is untrusted and validation fails, redirect to a safe default (e.g. `/`) instead."],"exampleFix":"// before\nredirect(302, formData.get('next'));\n// after\nconst next = String(formData.get('next') ?? '/');\nif (!/^[\\u0021-\\u007E]+$/.test(next) || !next.startsWith('/')) redirect(302, '/');\nelse redirect(302, next);","handlingStrategy":"validation","validationCode":"function safeLocation(loc) {\n  const s = String(loc).trim();\n  return /[\\u0000-\\u001F\\u007F]/.test(s) ? null : s;\n}\nconst loc = safeLocation(input);\nif (!loc) redirect(302, '/');","typeGuard":"const isHeaderSafe = (s) => typeof s === 'string' && s.length > 0 && !/[\\u0000-\\u001F\\u007F]/.test(s);","tryCatchPattern":"try {\n  new Headers({ location: target });\n  redirect(302, target);\n} catch {\n  redirect(302, '/'); // safe fallback\n}","preventionTips":["Never pass raw user input as the location header value.","Strip control characters and trim before redirecting.","Prefer relative paths for internal navigation.","Treat newline characters in redirect targets as an injection attempt."],"tags":["redirect","header-injection","validation","http","sveltekit"],"backgroundTag":"invalid-redirect-location","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}