RETURN_URL_NOT_ALLOWED

Return URL not allowed

HTTP status 400 Bad Request, code RETURN_URL_NOT_ALLOWED.

What it means#

The checkout's returnUrl is not one the hosted completion page may send the buyer back to. It must be https (or http on a loopback address), and its origin must be one of the channel's customerFacing.allowedOrigins (a loopback origin too). It is checked before any redirect is made, so the hosted page is never an open redirect.

What to do#

Send a returnUrl on one of the channel's allowed origins, or add the origin to the channel.

On the wire#

Every error response carrying this code names this page in error.moreInfo, with the request id in the query string. See Error codes for the response shape and the list of every code.