Enhanced navigation does not support making a non-GET reques

Error message

Enhanced navigation does not support making a non-GET request to an endpoint that redirects to an external origin. Avoid enabling enhanced navigation for form posts that may perform external redirections.

What it means

Thrown by performEnhancedPageLoad (NavigationEnhancement.ts:241) during an enhanced (fetch-based) form submission whose response is opaque — which means the server redirected a non-GET (POST/PUT/etc.) request to an external origin. Because the request used mode:'no-cors' to avoid leaking cross-origin content into the DOM, an external redirect on a non-GET cannot be retried as a full page load safely, so Blazor aborts with this error rather than silently failing.

Source

Thrown at src/Components/Web.JS/src/Services/NavigationEnhancement.ts:241

  }, fetchOptions));
  let isNonRedirectedPostToADifferentUrlMessage: string | null = null;
  await getResponsePartsWithFraming(
    responsePromise, abortSignal,
    (response, initialContent) => {
      const isGetRequest = !fetchOptions?.method || fetchOptions.method === 'get';
      const isSuccessResponse = response.status >= 200 && response.status < 300;

      // For true 301/302/etc redirections to external URLs, we'll receive an opaque response
      // (even if it has CORS enabled, since we passed no-cors), and the browser won't disclose
      // the target URL to JS code. We must therefore retry as a non-enhanced-nav page load to reach
      // the destination. This also has the benefit that we can be certain not to introduce content
      // from an external origin into the DOM here.
      if (response.type === 'opaque') {
        if (isGetRequest) {
          retryEnhancedNavAsFullPageLoad(internalDestinationHref);
          return;
        } else {
          throw new Error('Enhanced navigation does not support making a non-GET request to an endpoint that redirects to an external origin. Avoid enabling enhanced navigation for form posts that may perform external redirections.');
        }
      }

      if (isSuccessResponse && response.headers.get('blazor-enhanced-nav') !== 'allow') {
        // This appears to be a non-Blazor-Endpoint success response. We don't want to use enhanced nav
        // because the content we receive is not designed to be patched into an existing frame,
        // and may be incompatible with the Blazor JS that's already here.
        // The reason we don't apply the same logic for non-success responses is that:
        //  - We don't want to retry as then developers will get double-failures in logs
        //  - We really want to show error pages to avoid losing vital debugging info
        // ... and since error pages can be considered terminally fatal, we don't have to worry about
        // whether the page has complex client-side behaviors that are incompatible with our JS.
        if (isGetRequest) {
          retryEnhancedNavAsFullPageLoad(internalDestinationHref);
          return;
        } else {
          throw new Error('Enhanced navigation does not support making a non-GET request to a non-Blazor endpoint. Avoid enabling enhanced navigation for forms that post to a non-Blazor endpoint.');
        }

View on GitHub (pinned to 294cab2f9b)

Solutions

Remove data-enhance from forms that may redirect externally (let them do a native full POST).
Return the external URL via the blazor-enhanced-nav-redirect-location header instead of an HTTP redirect, so Blazor can location.replace cleanly.
Change the form method to 'get' if semantics allow.
Handle the redirect server-side and surface a normal Blazor response.

Example fix

<!-- before -->
<form method="post" data-enhance action="/pay">

<!-- after: external redirect not safe for enhanced nav -->
<form method="post" action="/pay">
<!-- server returns header 'blazor-enhanced-nav-redirect-location: https://gateway.example' -->

Defensive patterns

Strategy: validation

Validate before calling

function isSafeForEnhancedPost(form: HTMLFormElement): boolean {
  const get = (form.getAttribute('method') || 'get').toLowerCase();
  return get === 'get'; // POSTs that may redirect externally are unsafe for enhanced nav
}

Type guard

function formMayRedirectExternally(form: HTMLFormElement): boolean {
  // conservative: any POST form whose action host differs from current origin
  try {
    const u = new URL(form.getAttribute('action') || form.action, document.baseURI);
    return u.origin !== location.origin;
  } catch { return true; }
}

Try / catch

try {
  await performEnhancedPageLoad(url, false, fetchOptions);
} catch (e) {
  if (/redirects to an external origin/.test((e as Error).message)) {
    // fall back: submit the form natively without enhanced nav
  } else { throw e; }
}

Prevention

Do not mark externally-redirecting POST forms with data-enhance.
Use the blazor-enhanced-nav-redirect-location header for external redirects.
Prefer 'get' forms when semantics allow.

When it happens

Trigger: An enhanced form (data-enhance) with method POST/PUT/etc. whose endpoint returns a 30x redirect to a different origin (different scheme/host/port).

Common situations: A Blazor form posting to an endpoint that redirects to a third-party payment provider, SSO, or external service; OAuth callbacks; payment gateways; cross-domain redirects after form submission.

Related errors

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/461c6c49ca5cdc3b. Report an issue: GitHub.