toeverything/AFFiNE · error

Blocked redirect to untrusted domain

Error message

Blocked redirect to untrusted domain

What it means

Warning logged by the redirect page loader when `isAllowedRedirectTarget` rejects the requested `redirect_uri` — the target domain is not on the allowlist (or is the current host in a disallowed way), so navigation is refused and the page renders with allow:false. This is an open-redirect guard; the input at fault is an untrusted redirect_uri query parameter.

Source

Thrown at packages/frontend/core/src/desktop/pages/redirect/index.tsx:30

export const loader: LoaderFunction = async ({ request }) => {
  const url = new URL(request.url);
  const searchParams = url.searchParams;
  const redirectUri = searchParams.get('redirect_uri');

  if (!redirectUri) {
    return { allow: false };
  }

  if (
    isAllowedRedirectTarget(redirectUri, {
      currentHostname: window.location.hostname,
    })
  ) {
    location.href = redirectUri;
    return { allow: true };
  }

  logger.warn('Blocked redirect to untrusted domain', redirectUri);
  return { allow: false };
};

export const Component = () => {
  const { allow } = useLoaderData() as { allow: boolean };

  if (allow) {
    return null;
  }

  return <Navigate to="/404" />;
};

View on GitHub (pinned to b4c8548c09)

Solutions

1. Only redirect to trusted, allow-listed domains.
2. Add the domain to the trusted list if legitimate.

When it happens

Trigger: Triggered when the desktop redirect page receives a redirectUri whose target fails the isAllowedRedirectTarget check, so navigation is refused.

Common situations: Occurs when an OAuth or deep-link flow attempts to redirect to an untrusted external domain. Use an allowed redirect target; the app stays on the current page otherwise.

AI-assisted analysis of toeverything/AFFiNE@b4c8548c09 (2026-08-18). Data as JSON: /api/errors/96b0ee3ea170bea7. Report an issue: GitHub.