goharbor/harbor · error

cannot redirect to other site

Error message

cannot redirect to other site

What it means

Error "cannot redirect to other site" thrown in goharbor/harbor.

Source

Thrown at src/core/controllers/oidc.go:84

// RedirectLogin redirect user's browser to OIDC provider's login page
func (oc *OIDCController) RedirectLogin() {
	state := utils.GenerateRandomString()
	pkceCode, err := pkce.Generate()
	if err != nil {
		log.Errorf("failed to generate PKCE code, error: %v", err)
		oc.SendInternalServerError(err)
		return
	}
	url, err := oidc.AuthCodeURL(oc.Context(), state, pkceCode)
	if err != nil {
		oc.SendInternalServerError(err)
		return
	}
	redirectURL := oc.Ctx.Request.URL.Query().Get("redirect_url")
	if !utils.IsLocalPath(redirectURL) {
		log.Errorf("invalid redirect url: %v", redirectURL)
		oc.SendBadRequestError(fmt.Errorf("cannot redirect to other site"))
		return
	}
	if err := oc.SetSession(redirectURLKey, redirectURL); err != nil {
		log.Errorf("failed to set session for key: %s, error: %v", redirectURLKey, err)
		oc.SendInternalServerError(err)
		return
	}
	if err := oc.SetSession(pkceCodeKey, string(pkceCode)); err != nil {
		log.Errorf("failed to set session for key: %s, error: %v", pkceCodeKey, err)
		oc.SendInternalServerError(err)
		return
	}
	if err := oc.SetSession(stateKey, state); err != nil {
		log.Errorf("failed to set session for key: %s, error: %v", stateKey, err)
		oc.SendInternalServerError(err)
		return
	}
	log.Debugf("State dumped to session: %s", state)

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/core/controllers/oidc.go:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/195894256091760c. Report an issue: GitHub.