n8n-io/n8n · error · OperationalError

Invalid redirect location received from server: ${location}

Error message

Invalid redirect location received from server: ${location}

What it means

OperationalError thrown by resolveRedirectUrl when `new URL(location, currentUrl)` throws — i.e. the server returned a redirect (3xx) with a Location header that is not a parseable URL. This is a server-side protocol violation; the redirect chain is aborted because there is no valid target to validate against the SSRF policy.

Source

Thrown at packages/@n8n/backend-network/src/http/axios/redirect.ts:210

		throw new AxiosError(
			`Request failed with status code ${response.status}`,
			code,
			response.config,
			response.request,
			response,
		);
	}
}

/**
 * Resolves a redirect `Location` against the current URL.
 * @throws OperationalError when the server returns a malformed Location that cannot be resolved.
 */
function resolveRedirectUrl(location: string, currentUrl: string): string {
	try {
		return new URL(location, currentUrl).href;
	} catch {
		throw new OperationalError(`Invalid redirect location received from server: ${location}`);
	}
}

/**
 * Follows redirects manually, validating the target of every hop against the SSRF policy (DNS + IP),
 * so a redirect cannot reach a target the initial pre-flight check never saw,
 * including hostname targets carried by a proxy.
 */
export async function followSsrfRedirects(
	initialConfig: AxiosRequestConfig,
	policy: SsrfRedirectPolicy,
): Promise<AxiosResponse> {
	const maxRedirects = initialConfig.maxRedirects ?? MAX_REDIRECTS_DEFAULT;
	const originalUrl =
		buildTargetUrl(initialConfig.url, initialConfig.baseURL) ?? initialConfig.url ?? '';
	const baseValidateStatus =
		initialConfig.validateStatus ?? ((status: number) => status >= 200 && status < 300);

View on GitHub (pinned to 5ac6606e81)

Solutions

Capture the exact Location header value (it is embedded in the message) and inspect it.
Treat the target endpoint as broken and surface a clear upstream error to the operator.
If you control the server, fix the redirect to emit an absolute or correctly-rooted URL.
Do not attempt to 'repair' the URL client-side — the SSRF policy cannot safely validate garbage.

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-validate any Location you control before emitting it
function isValidLocation(loc: string, base: string): boolean {
  try { new URL(loc, base); return true; } catch { return false; }
}

Type guard

import { OperationalError } from 'n8n-workflow';
const isInvalidRedirect = (e: unknown): boolean =>
  e instanceof OperationalError && /Invalid redirect location/.test(e.message);

Try / catch

try {
  const res = await followSsrfRedirects(config, policy);
} catch (e) {
  if (e instanceof OperationalError && /Invalid redirect location/.test(e.message)) {
    // upstream is broken — do not retry the same URL; surface a clear error
  }
  throw e;
}

Prevention

Do not try to repair malformed Location values client-side — SSRF policy cannot safely validate them.
Treat a malformed-redirect error as a server defect and alert the upstream owner.
Log the raw Location header for diagnosis when this fires.

When it happens

Trigger: A 3xx response in followSsrfRedirects carries a Location header that new URL() cannot parse (e.g. control characters, a missing scheme with no base resolution possible, or an entirely malformed value). resolveRedirectUrl catches and rethrows as OperationalError.

Common situations: Misconfigured upstream returns 'Location: //'; a server emits a relative path with no leading slash and no usable base; a security appliance injects a broken redirect; binary/garbage bytes leak into the header.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/5ffb4df74f84f029. Report an issue: GitHub.