expressjs/express · warning

Provide a url argument

Error message

Provide a url argument

What it means

A deprecation warning (via `deprecate()`, not a throw) emitted by `res.redirect` when the url argument is falsy. Historically Express tolerated a missing url (and the removed magic 'back' string relied on loose handling); this now warns because execution continues into `res.location(address)` with an invalid value, producing a broken Location header, and a future major version will make it a hard error.

Source

Thrown at lib/response.js:827

 *    res.redirect(301, 'http://example.com');
 *    res.redirect('../login'); // /blog/post/1 -> /blog/login
 *
 * @public
 */

res.redirect = function redirect(url) {
  var address = url;
  var body;
  var status = 302;

  // allow status / url
  if (arguments.length === 2) {
    status = arguments[0]
    address = arguments[1]
  }

  if (!address) {
    deprecate('Provide a url argument');
  }

  if (typeof address !== 'string') {
    deprecate('Url must be a string');
  }

  if (typeof status !== 'number') {
    deprecate('Status must be a number');
  }

  // Set location header
  address = this.location(address).get('Location');

  // Support text/{plain,html} by default
  this.format({
    text: function(){
      body = statuses.message[status] + '. Redirecting to ' + address
    },

View on GitHub ↗ (pinned to a3714473fe)

Solutions

1. Always pass a non-empty url: guard the computed target and fall back, e.g. `res.redirect(req.query.returnTo || '/')`.
2. If replacing the removed 'back' behavior, use `res.redirect(req.get('Referrer') || '/')`.
3. If you meant to send only a status, use `res.sendStatus(status)` instead of redirect.

Example fix

// before
res.redirect(req.session.returnTo);
// after
res.redirect(req.session.returnTo || '/');

const target = redirectMap[req.params.key];
if (!target) {
  return res.status(404).send('Unknown redirect');
}
res.redirect(target);

function hasUrl(u) {
  return u !== undefined && u !== null && u !== '';
}

When it happens

Trigger: `res.redirect()` with no argument, `res.redirect(undefined)` from an unresolved variable, or `res.redirect(302)` (status only, no url — the single argument is treated as the url).

Common situations: Redirect targets built from optional request data (returnTo query param, session value) that is absent; upgrades from Express 4 where `res.redirect('back')` was removed and code now passes undefined; calling redirect with only a status code.

Related errors

• Url must be a string
• Status must be a number
• name argument is required to req.get
• name must be a string to req.get
• app.use() requires a middleware function

AI-assisted analysis of expressjs/express@a3714473fe (2026-07-31). Data as JSON: /data/errors/fb748dd64b151d09.json. Report an issue: GitHub ↗.