Since I upgraded from 5.24.4 to CiviCRM 5.28.2, roughly since end of August 2020, I have been finding a lot of errors in the log when Anonymous users attempt to access mysite.com/civicrm/mailing/url.

  • If I go to this URL myself (as an admin) I get the CiviCRM error box with the message "Error: Could not find valid value for u".
  • If I go there as Anonymous I get the same error message on a blank white screen.
  • On 5.24.4 Anonymous gets 'Access Denied' which is sensible, and Admin gets a list of current mailings.

What should this URL do?

Presumably 5.28.2 has introduced a bug?

2 Answers 2


I have struggled with this error for months. Here is how I finally fixed it.

On our site, when a person tries to access a URL, if they are not previously authenticated then the URL they access is intercepted and they are directed to a login screen. We use logintoboggan modules for this on Drupal, but I suspect it works this way for most sites.

The issue is that when users click the link in the email, the URL they click has parameters (including the u value) -- and when access to that URL is intercepted those parameters get stripped. So once they do authenticate, they end up at a URL without the requisite parameters.

You can see this happen for yourself if you copy the link out of your email and paste it into a Chrome browser with DevTools turned on. You'll see that the first URL the user accesses is the click tracking URL that has the u URL parameter but then they get redirected to the login page without the URL parameters.

The solution is to ensure that the click tracking URL does not require any authentication.

In Drupal there is no CiviCRM permission for the click tracking URL, so you cannot grant "anonymous" access to do this. Instead, we entered that URL in the require_login configuration section under "excluded URLs". See the screenshot I have attached.

This immediately solved the problem: users would click the link to the email, they would be directed to the click tracking URL which would accept their click and forward them to the proper URL, which then would get intercepted if they aren't logged in, but post login they would be sent to the correct destination. This works even if the destination URL has URL parameters in it, e.g. if it is a CiviCRM page.

I also have to say that I tried many patches to logintobbogan module that did not help the situation. My suspicion is that there is something in the CiviCRM URL tracking module that does not play nicely with authentication intercepts, because no amount of fussing with logintoboggan module would help, and also because now with the current configuration users are directed to the destination properly even if that destination has URL parameters in it.

Hope this helps -- I tore my hair out on this one for a long time. :)

enter image description here


What should this URL do?

This URL is used to track the number of clicks done on the URL included in mailings.

When the URL is included in mailing, it is in the format of civicrm/mailing/url?qid=<mailing_queue_id>&u=<url_id>

If there is no URL id (u parameter), use of the above link is invalid, hence the error.

So i think you should never have this URL without u query string in it. How do you get this URL from?

  • I don't understand where it is coming from. I see an error in the log saying that user Anonymous was trying to access that URL.
    – user6274
    Sep 19, 2020 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.