Home Search Pricing Get inErrata About

Sign in Sign up

Graph/conflicting-tls-redirect-loop

Pattern

Conflicting TLS Redirects

conflicting-tls-redirect-loop

Conflicting SSL/TLS and redirect configuration between edge/CDN/proxy and the app causes clients to bounce between HTTP/HTTPS or domains until redirect limits hit (e.g., net::ERR_TOO_MANY_REDIRECTS) or proxies return 502/port-detection failures.

Node Details

Public graph metadata

Updated7/5/2026

Connections

30 linked nodes

Google Search Console saying that there are too many redirects on my homepage — on my homepage. Tension: I want the redirect to happen to both - http and non-www. Outcome: when i enter `curl -I -L http://fiziokaspars.lv`, i get double redirect.

I keep running into a `net::ERR_TOO_MANY_REDIRECTS` error when I try to access my site at `www.example.io` — setting up my Next.js project hosted on Vercel with a custom domain managed through Cloudflare. Tension: Despite configuring the DNS and SSL settings correctly. Outcome: Turns out Vercel provides documentation about how to fix it for Cloudflare.

I get exception of Invalid saml response. — I redirect the browser then from XYZ app to Keycloak using the redirect URI i get from Identity provider i configured. Tension: I have few questions which if get clear can help me complete this flow.

requests with the forbidden fields sailed through to the write path. Tension: accepting them would let one client rewrite server-derived state. Outcome: surfacing as a 500 from an unrelated downstream failure in our integration test.

If I proxy 6 streams, then my FastAPI app stops accepting any further requests — testing the application through a web browser. Outcome: all subsequent requests would get stalled and queued, until a connection is available.

When deployed on Azure App Service behind a proxy, FastAPI/Starlette redirects requests to an HTTP URL (e.g., HTTP Location header in a 307) instead of preserving HTTPS. This causes browser mixed-content/security failures because the app is loaded over HTTPS but redirected to HTTP.

When I send an HTTPS request using the Swagger UI. Tension: the redirection then fails. Outcome: I found a solution by referring to this GitHub issue: https://github.com/encode/uvicorn/issues/369.

AADSTS9002325: Proof Key for Code Exchange is required for cross-origin authorization code redemption. Tension: redirects uris not matching.

The problem is that now the connection ends in a timeout error. Tension: azure refuses the connection attempt due to the ssl dependency.

The Flutter Linux app calling local FastAPI endpoints fails with a DioException [bad response] due to an HTTP 307 (Temporary Redirect). Postman requests succeed, but the app always receives the redirect response.

Checkout redirect can be faked by appending the success query string or spoofing the HTTP referer

localhost redirected you too many times — if user is admin, admin/main/users or admin/path* not working. Outcome: not-admin redirecting is working.

The Heroku-hosted MERN app receives many automated-looking requests from the same forwarded IP in the same second, with suspicious query/path content (e.g., unexpected “if”/“php” strings). This behavior appears to be scanning or an attack proxy and raises concerns about security and abuse.

close: Bad file descriptor (9) — proxychains google-chrome-beta dnsleaktest.com. Tension: the core gets dumped due to "Bad file descriptor". Outcome: Trace/breakpoint trap (core dumpe.

502 "Bad Gateway nginx/1.20.1"-Error — Now when I enter http://localhost there is warning if I rly trust the website. I say yes and now I´m on https://localhost. Tension: it usually should open Prefect UI but I have a 502 "Bad Gateway nginx/1.20.1"-Error. Outcome: I would like to run Prefect over https.

Browsers started logging a Content Security Policy (CSP) violation indicating that requests to https://vortex.data.microsoft.com/collect/v1 were refused because the page’s connect-src directive does not allow that endpoint.

I want to accept that fact that proxy is using insecure TLS certificates but I still want to establish secure TLS session to my destination. Tension: I can only disable TLS verification to both proxy and destination with `InsecureSkipVerify`.

on Chrome I get an error saying that the CSRF token is mismatched — show a third-party web page (with their approval) in an iframe. Tension: This site has a different domain to my parent site. Outcome: The site displays fine on firefox.

Accessing https://example.com results in a “too many redirects” loop, while other domain variants redirect correctly for a React app served by Apache with Cloudflare-managed DNS/SSL.

When a REST call returns 403, the React SPA is redirected to the sign-in page, but in development React StrictMode causes the redirect to happen twice (pushing two history entries).

we are seeing 500 errors when hitting some backend endpoints — we have a react-based (version 16.14.0) PWA that is hosted on Microsoft Azure app service plans (premium tier). Tension: It is ONLY affects POST endpoints. GET endpoints successfully continue to work to these backends. Outcome: Current workaround is to change your app service to use http 1.1.

File uploads submitted from Safari to a Tomcat server become corrupted when HTTP/2 is enabled; uploads succeed in Chrome and when HTTP/2 is disabled. The issue affects multiple medium-sized files (a few MB).

the first request is always failing since the http-proxy doesn't recognize it as a websocket request. Tension: I struggled to decrypt the accessToken in time and add it to the request before it's sent. Outcome: for now it's not bothering me that much.

I see multiple redirects in the network tab. I have this error: ERR_TOO_MANY_REDIRECTS — I'm working on a REST API using Java 21 with Spring Boot 3.3, and I'm trying to implement authentication through an external site using OpenID.

upstream prematurely closed connection while reading response header from upstream — When a user in my Django application installed on Ubuntu from DigitalOcean (v18+) selects multiple files to send on server. Tension: 502 Bad Gateway. Outcome: Changing the droplet size on DigitalOcean solved my problem.

WebSocket connections to `wss://<host>:443` fail when proxied via `tailscale serve` (e.g., port 443 → localhost backend), producing `ERR_SSL_PROTOCOL_ERROR`/TLS internal error and closing immediately. The same backend and proxy config works correctly when served on a custom port (e.g., 8443).

In Next.js 15 App Router server actions, calling `redirect()` inside a `try/catch` causes `NEXT_REDIRECT` to be thrown and then swallowed by the `catch`, preventing the redirect from happening.

Wget before 1.21.1 forwards HTTP Authorization headers to different origins when following cross-origin redirects. — when following cross-origin redirects. Tension: An attacker-controlled server can respond with a 302 redirect to its own domain and capture the victim's credentials. Outcome: This is a critical information-leak vulnerability that affects users who authenticate to legitimate websites and are then redirected to attacker-controlled servers.

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

throws "Cookies can only be modified in a Server Action or Route Handler" — called from Next.js 15 Server Components (pages, layouts). Tension: The error appears intermittently — only when the session needs refreshing (controlled by `updateAge` config). Outcome: With `updateAge: 300` (5 minutes), it crashes every ~5 minutes for active users.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata