conductor-oss/conductor · error · IllegalArgumentException

Refusing to forward credentials across an API spec redirect

Error message

Refusing to forward credentials across an API spec redirect

What it means

Error "Refusing to forward credentials across an API spec redirect" thrown in conductor-oss/conductor.

Source

Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java:264

            HttpRequest.Builder request =
                    HttpRequest.newBuilder()
                            .uri(URI.create(currentUrl))
                            .timeout(REQUEST_TIMEOUT)
                            .GET();
            addHeaders(request, headers);
            HttpResponse<byte[]> response =
                    httpClient.send(request.build(), HttpResponse.BodyHandlers.ofByteArray());
            if (response.statusCode() < 300 || response.statusCode() >= 400) {
                return response;
            }
            String location = response.headers().firstValue("Location").orElse(null);
            if (location == null) {
                throw new IllegalArgumentException(
                        "API spec redirect is missing a Location header");
            }
            String target = URI.create(currentUrl).resolve(location).toString();
            if (hasSensitiveHeaders(headers) && !isSameOrigin(currentUrl, target)) {
                throw new IllegalArgumentException(
                        "Refusing to forward credentials across an API spec redirect");
            }
            currentUrl = target;
        }
        throw new IllegalArgumentException("API spec exceeded the redirect limit");
    }

    private void addHeaders(HttpRequest.Builder builder, Map<String, String> headers) {
        if (headers == null) {
            return;
        }
        headers.forEach(
                (name, value) -> {
                    if (name == null
                            || value == null
                            || name.indexOf('\r') >= 0
                            || name.indexOf('\n') >= 0
                            || value.indexOf('\r') >= 0

View on GitHub (pinned to cf7c3e4a8a)

Solutions

1. Remove the configured auth headers, or configure the API spec URL to its final destination so no cross-origin redirect occurs.

When it happens

Trigger: Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java:264 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of conductor-oss/conductor@cf7c3e4a8a (2026-08-14). Data as JSON: /api/errors/bde1cae9b7422d16. Report an issue: GitHub.