ruvnet/ruflo · error

Redirect to unsafe URL blocked (SSRF)

Error message

Redirect to unsafe URL blocked (SSRF)

What it means

Log warning in the fetch-url GET handler: a redirect hop during manual redirect-following pointed to a URL rejected by isValidUrl (SSRF guard — non-HTTPS or private target), so the redirect chain is blocked and the fetch aborted.

Source

Thrown at ruflo/src/ruvocal/src/routes/api/fetch-url/+server.ts:97

				},
			});

			if (response.status >= 300 && response.status < 400) {
				redirectCount++;
				if (redirectCount > MAX_REDIRECTS) {
					throw error(502, "Too many redirects");
				}

				const location = response.headers.get("location");
				if (!location) {
					throw error(502, "Redirect without Location header");
				}

				// Resolve relative redirects against the current URL
				const redirectUrl = new URL(location, currentUrl).toString();

				if (!isValidUrl(redirectUrl)) {
					logger.warn(
						{ redirectUrl, originalUrl: targetUrl },
						"Redirect to unsafe URL blocked (SSRF)"
					);
					throw error(403, "Redirect target is not allowed");
				}

				currentUrl = redirectUrl;
				continue;
			}

			break;
		}
	} finally {
		clearTimeout(timeoutId);
	}

	if (!response.ok) {
		logger.error({ targetUrl, response }, "Error fetching URL. Response not ok.");

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Do not follow redirects to private or non-HTTPS targets; request the final safe URL directly.

When it happens

Trigger: Thrown at ruflo/src/ruvocal/src/routes/api/fetch-url/+server.ts:97 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/dda7ac7708b55b15. Report an issue: GitHub.