{"id":"fb748dd64b151d09","repo":"expressjs/express","slug":"provide-a-url-argument","errorCode":null,"errorMessage":"Provide a url argument","messagePattern":"Provide a url argument","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/response.js","lineNumber":827,"sourceCode":" *    res.redirect(301, 'http://example.com');\n *    res.redirect('../login'); // /blog/post/1 -> /blog/login\n *\n * @public\n */\n\nres.redirect = function redirect(url) {\n  var address = url;\n  var body;\n  var status = 302;\n\n  // allow status / url\n  if (arguments.length === 2) {\n    status = arguments[0]\n    address = arguments[1]\n  }\n\n  if (!address) {\n    deprecate('Provide a url argument');\n  }\n\n  if (typeof address !== 'string') {\n    deprecate('Url must be a string');\n  }\n\n  if (typeof status !== 'number') {\n    deprecate('Status must be a number');\n  }\n\n  // Set location header\n  address = this.location(address).get('Location');\n\n  // Support text/{plain,html} by default\n  this.format({\n    text: function(){\n      body = statuses.message[status] + '. Redirecting to ' + address\n    },","sourceCodeStart":809,"sourceCodeEnd":845,"githubUrl":"https://github.com/expressjs/express/blob/a3714473feb3d2908add734d340e7755fd85e0a3/lib/response.js#L809-L845","documentation":"A deprecation warning (via `deprecate()`, not a throw) emitted by `res.redirect` when the url argument is falsy. Historically Express tolerated a missing url (and the removed magic 'back' string relied on loose handling); this now warns because execution continues into `res.location(address)` with an invalid value, producing a broken Location header, and a future major version will make it a hard error.","triggerScenarios":"`res.redirect()` with no argument, `res.redirect(undefined)` from an unresolved variable, or `res.redirect(302)` (status only, no url — the single argument is treated as the url).","commonSituations":"Redirect targets built from optional request data (returnTo query param, session value) that is absent; upgrades from Express 4 where `res.redirect('back')` was removed and code now passes undefined; calling redirect with only a status code.","solutions":["Always pass a non-empty url: guard the computed target and fall back, e.g. `res.redirect(req.query.returnTo || '/')`.","If replacing the removed 'back' behavior, use `res.redirect(req.get('Referrer') || '/')`.","If you meant to send only a status, use `res.sendStatus(status)` instead of redirect."],"exampleFix":"// before\nres.redirect(req.session.returnTo);\n// after\nres.redirect(req.session.returnTo || '/');","handlingStrategy":"validation","validationCode":"const target = redirectMap[req.params.key];\nif (!target) {\n  return res.status(404).send('Unknown redirect');\n}\nres.redirect(target);","typeGuard":"function hasUrl(u) {\n  return u !== undefined && u !== null && u !== '';\n}","tryCatchPattern":null,"preventionTips":["Guard the redirect target before calling res.redirect — a missing map entry or empty query param produces undefined","Return an explicit 404/400 when the redirect target can't be resolved","Never call res.redirect() with a variable you haven't null-checked"],"tags":["express","redirect","deprecation"],"analyzedSha":"a3714473feb3d2908add734d340e7755fd85e0a3","analyzedAt":"2026-07-31T18:55:36.968Z","schemaVersion":2}