Problem/Motivation

After updating my projects to core 11.4.3, clicking on the link to Check manually on /admin/reports/updates gives the following error:

Redirects to external URLs are not allowed by default, use \Drupal\Core\Routing\TrustedRedirectResponse for it.

I have experienced this on various remote environments. Local dev works fine. Would assume this is a bug, since the function is not redirecting to URLs external to the site. All other site functions, from what I can tell, work fine, and running this before the 11.4.3 update appeared to work nominally. To be sure, caches were flushed via `drush cr`, and database updates via `drush updb` had been run.

Likewise, reviewing system paths via `drush st` for each environment shows nothing amiss.

In checking the system logs, see that this error has been tracked, and the URL path is:

[URL]/admin/reports/updates/check?destination=%2Fadmin%2Freports%2Fupdates%3Fq%3Dadmin%2Freports%2Fupdates&q=admin%2Freports%2Fupdates%2Fcheck&token=[Token]

From my read, this function is being called multiple times, which may be the reason the external URL block is being triggered.

Steps to reproduce

Log into remote environments, click Check manually on /admin/reports/updates

Comments

karolus created an issue. See original summary.

karolus’s picture

karolus commented
Issue summary: View changes
karolus’s picture

karolus commented
Issue summary: View changes
cilefen’s picture

cilefen commented
Component: batch system » update.module
Issue tags: -core, -redirect

Is the redirect module installed?

What was the prior Drupal version? Is it reproducible on a new Drupal installation? Please update the summary with that information.

cilefen’s picture

cilefen commented
Title: Redirect Issue » “Redirects to external URLs are not allowed by default” using “check manually” on available updates report
cilefen’s picture

cilefen commented

Can we get a stack trace?

karolus’s picture

karolus commented

No, the Redirect module is not installed. Prior core version was 11.4.2. Just to be sure—on the stack trace, do you want verbose logging?

This is what I have:

https:/[domain.tld]/admin/reports/updates/check?destination=%2Fadmin%2Freports%2Fupdates%3Fq%3Dadmin%2Freports%2Fupdates&q=admin%2Freports%2Fupdates%2Fcheck&token=[Token string]

I can spin up a new installation, but the issue doesn't reproduce locally on dev for this project.

cilefen’s picture

cilefen commented
Issue tags: +Needs steps to reproduce

I can't reproduce it on a new DDEV install, so a platform difference is probably involved. Not very much changed in 11.4.3, so it should be possible to determine which change changed a behavior.

karolus’s picture

karolus commented

Thanks!

I'm going through all my configs and logs now. Found the same issue when using drush uli @[Remote] this morning. Will report back with what I find.

karolus’s picture

karolus commented

@cilefen, it appears others have been having this issue as well, per this comment. Looks to be tied to the 11.4 updates, if the information is correct.

As per that string, I'm running the remote environments in subfolders, and did a thorough check on my .htaccess in the root folder, and the settings.php in the Drupal instance. Right now, the site works fine for anonymous users—no errors on reaching the homepage, or any other content. I can also access remotely via Drush commands.

I do get the redirect error when attempting these tasks:

  • Login via drush uli—but all looks OK in the CLI, only when pasting the string in the browser is where it happens
  • Logout via command in Admin Toolbar
  • Checking available updates manually at /admin/reports/updates
apparatchik’s picture

apparatchik commented

We're also experimenting this issue after updating to 11.4.4 from 11.3.11 for a site on a subfolder (/web), the prior htaccess solution (RewriteBase /web) seems to not work anymore.

Per this comment it's suggested to use DocumentRoot at the host settings but this is not an option for many of the cPanel or cPanel-like hosting providers where htaccess is the only way available to affect host settings.

ressa’s picture

ressa
he/him
commented

Thanks a lot for adding details about scenarios when this happens @karolus and @apparatchik. I was not sure if there was only a tangential overlap with the other issue, but after reproducing all the scenarios, I can confidently say (assuming you are redirecting to /web with .htaccess @karolus) that this issue is a duplicate of #2612160: .htaccess redirect on shared hosting error: Redirects to external URLs are not allowed by default, and I have added your observations over there.

About the documentation page linked to from "Per this comment it's suggested to use DocumentRoot ..." @apparatchik, I created that doc page a while ago, but do not yet host any Drupal 11 sites.

So either one of you should feel free to update the doc page, and add any caveats about Drupal 11.4, and recommendations about what to do right now, during this time, when Drupal 11.3 installations are stuck in a non-updatable limbo ...

It would still be nice to know which Drupal core code update caused this.

UPDATE: I tried stepping back though versions, and it started in Drupal 11.4.0. @cilefen: There are detailed steps on how to reproduce it in DDEV in the main issue, and it would be fantastic if the code change could be located.

cilefen’s picture

cilefen commented
Status: Active » Postponed (maintainer needs more info)
Issue tags: +Possible duplicate

I am postponing this issue on the likelihood it is a duplicate.

mookum’s picture

mookum commented

I experienced the same issue after updating to D.11.4.4

Fix:
https://www.drupal.org/docs/getting-started/system-requirements/relocate...

keshiuchi’s picture

keshiuchi commented

#14 Fixed the issue.

lionsea’s picture

lionsea commented

I experienced the same issue after uploading my dev website to prodsite, and I have this page after login and logout, now I refresh browser to deal with this issue every time login/logout at prod site.