# Query string and URL fragments not allowed in Logout returnUrl

**URL:** <https://community.auth0.com/t/query-string-and-url-fragments-not-allowed-in-logout-returnurl/181593>\
**Category:** Get Help\
**Tags:** login-experience, new-universal-login-experience\
**Created:** [February 6, 2025, 5:25pm UTC](https://community.auth0.com/t/query-string-and-url-fragments-not-allowed-in-logout-returnurl/181593 "2025-02-06T17:25:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![VictorioBerra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/victorioberra/32/28773_2.png) [@VictorioBerra](https://community.auth0.com/u/VictorioBerra)\
**Post date:** [February 6, 2025, 5:25pm UTC](https://community.auth0.com/t/query-string-and-url-fragments-not-allowed-in-logout-returnurl/181593/1 "2025-02-06T17:25:14Z")

</div>

We have a custom trigger that redirects to logout, and then to our custom error page.

Why?

We are using SAML Addon, and some (many) vended apps using SAML do not display the deny reason when we deny with `api.access.deny("blah")` In general, we notice inconsistent behavior with `api.access.deny("blah")` accross different IdPs (like OIDC and SAML).

We do not need to support a continue scenario. If our authorization code determines a user should not be able to login to a client, we want them immediately to go to our custom error page with a friendly message on why they are not allowed and a link to contact support.

This will fail with “The returnTo URL is malformed”

```js
const customErrorPageUrl = encodeURIComponent(
    `${returnTo}?error_description=${message}`
);
const redirectionUrl = `https://${event.tenant.id}.us.auth0.com/v2/logout?returnTo=${customErrorPageUrl}`;
api.redirect.sendUserTo(redirectionUrl);

```

This will fail with “The returnTo URL is malformed”

```js
const customErrorPageUrl = encodeURIComponent(
    `${returnTo}#error_description=${message}`
);
const redirectionUrl = `https://${event.tenant.id}.us.auth0.com/v2/logout?returnTo=${customErrorPageUrl}`;
api.redirect.sendUserTo(redirectionUrl);

```

**It is not possible to redirect to a custom error page with a reason.**

The docs are not clear on this: [Redirect Users with Alternative Logout](https://auth0.com/docs/authenticate/login/logout/redirect-users-after-logout#limitations)

IE:

> - The validation of URLs provided as values to the `returnTo` parameter, the query string, and hash information provided as part of the URL **are not taken into account.**

But they are taken into account… they are not allowed at all.

Is there an alternative to what we are trying to do? Once again to be clear, I want to STOP the login process, do not issue a token/cookie/session, do not allow a “continue” scenario, send them directly to an oopsies page. This should work on ALL IdPs consistently.

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [February 12, 2025, 6:35pm UTC](https://community.auth0.com/t/query-string-and-url-fragments-not-allowed-in-logout-returnurl/181593/3 "2025-02-12T18:35:40Z")

</div>

Hi @VictorioBerra,

I have reviewed your code snippet and tested this on my end, but I could not reproduce the error you experienced. I am unsure what values you used for your `returnTo` but there seems to be an issue with how the URL is formed.

I suggest using `console.log()` statements to verify that your `redirectionUrl` is being formed correctly. If you need to check the `console.log()` statements during an actual login flow, you could use the [Real-time Webtask Logs Extension](https://auth0.com/docs/customize/extensions/real-time-webtask-logs) to verify the output.

Let me also add that calling the `api.access.deny()` method is meant to stop the login process and prevent issuing tokens.

You could alternatively use the `api.redirect.sendUserTo()` method, which executes before the login process is completed, to prevent the user from continuing with authentication.

Let me know if you have any questions.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 26, 2025, 6:36pm UTC](https://community.auth0.com/t/query-string-and-url-fragments-not-allowed-in-logout-returnurl/181593/4 "2025-02-26T18:36:04Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.