zaproxy/zaproxy · error · InvalidRedirectLocationException

Invalid redirect location: <location>

Error message

Invalid redirect location: <location>

What it means

Thrown by processRedirectResponse when the Location header of an HTTP 3xx redirect cannot be parsed into a valid URI. Fires during executeMethod when the server returns a malformed or unresolvable redirect target, so the redirect cannot be followed.

Source

Thrown at zap/src/main/java/org/apache/commons/httpclient/HttpMethodDirector.java:711

            }
			
            if (redirectUri.isRelativeURI()) {
				if (this.params.isParameterTrue(HttpClientParams.REJECT_RELATIVE_REDIRECT)) {
					LOG.warn("Relative redirect location '" + location + "' not allowed");
					return false;
				} else { 
					//location is incomplete, use current values for defaults
					LOG.debug("Redirect URI is not absolute - parsing as relative");
					redirectUri = new URI(currentUri, redirectUri);
				}
			} else {
                // Reset the default params
                method.getParams().setDefaults(this.params);
            }
            method.setURI(redirectUri);
            hostConfiguration.setHost(redirectUri);
		} catch (URIException ex) {
            throw new InvalidRedirectLocationException(
                    "Invalid redirect location: " + location, location, ex);
		}

        if (this.params.isParameterFalse(HttpClientParams.ALLOW_CIRCULAR_REDIRECTS)) {
            if (this.redirectLocations == null) {
                this.redirectLocations = new HashSet<>();
            }
            this.redirectLocations.add(currentUri);
            try {
                if(redirectUri.hasQuery()) {
                    redirectUri.setQuery(null);
                }
            } catch (URIException e) {
                // Should never happen
                return false;
            }

            if (this.redirectLocations.contains(redirectUri)) {

View on GitHub (pinned to 9d1970a436)

Solutions

1. Inspect the Location header returned by the server and fix it if you control the server
2. Enable lenient redirect handling or disable automatic redirect following and resolve the location manually
3. Upgrade the HttpClient/URI parser if the location uses syntax the old parser rejects

When it happens

Trigger: Thrown at zap/src/main/java/org/apache/commons/httpclient/HttpMethodDirector.java:711 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zaproxy/zaproxy@9d1970a436 (2026-09-05). Data as JSON: /api/errors/5785c3c5e6df22f2. Report an issue: GitHub.