What causes "edit: redirect url must be absolute" in kgretzky/evilginx2?

Prefix the value with a scheme, e.g. `lures edit redirect_url https://example.com`

edit: redirect url must be absolute

Error message

edit: redirect url must be absolute

What it means

The `lures edit <id> redirect_url <val>` command in evilginx2 parses the given value with net/url.Parse and requires an absolute URL (u.IsAbs()). This error means the lure's redirect_url was set to a value without a scheme, e.g. 'example.com/path' instead of 'https://example.com/path'.

Source

Thrown at core/terminal.go:959

							return fmt.Errorf("edit: %v", err)
						}
						l.Path = u.EscapedPath()
						if len(l.Path) == 0 || l.Path[0] != '/' {
							l.Path = "/" + l.Path
						}
					} else {
						l.Path = "/"
					}
					do_update = true
					log.Info("path = '%s'", l.Path)
				case "redirect_url":
					if val != "" {
						u, err := url.Parse(val)
						if err != nil {
							return fmt.Errorf("edit: %v", err)
						}
						if !u.IsAbs() {
							return fmt.Errorf("edit: redirect url must be absolute")
						}
						l.RedirectUrl = u.String()
					} else {
						l.RedirectUrl = ""
					}
					do_update = true
					log.Info("redirect_url = '%s'", l.RedirectUrl)
				case "phishlet":
					_, err := t.cfg.GetPhishlet(val)
					if err != nil {
						return fmt.Errorf("edit: %v", err)
					}
					l.Phishlet = val
					do_update = true
					log.Info("phishlet = '%s'", l.Phishlet)
				case "info":
					l.Info = val
					do_update = true

View on GitHub (pinned to 4c0988a1d9)

Solutions

Prefix the value with a scheme, e.g. `lures edit <id> redirect_url https://example.com`
Verify with `url.Parse` + `IsAbs()` before running the command
If the intent is to clear the redirect URL, pass an empty string instead

Example fix

// before
lures edit 0 redirect_url accounts.google.com
// after
lures edit 0 redirect_url https://accounts.google.com

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(val)
if err != nil || !u.IsAbs() {
    return errors.New("redirect_url must be an absolute URL, e.g. https://example.com")
}

Type guard

func isAbsoluteURL(s string) bool {
    u, err := url.Parse(s)
    return err == nil && u.IsAbs()
}

Try / catch

if _, err := url.Parse(val); err != nil {
    return fmt.Errorf("edit: %v", err)
}
if !u.IsAbs() {
    return fmt.Errorf("edit: redirect url must be absolute")
}

Prevention

Always include scheme+host (https://...) in redirect_url values
Test the value with url.Parse and IsAbs before applying
Pass an empty string to clear the field rather than a relative path

When it happens

Trigger: Running `lures edit <id> redirect_url` with a value like 'example.com' or '/path' that url.Parse succeeds on but IsAbs() reports false (no scheme://host).

Common situations: Operators entering a bare domain as redirect target, copying a path-only URL, or forgetting https:// when configuring post-login redirects for a lure.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/4e4681c69caa9a20. Report an issue: GitHub.