Too many redirects

LostMarble

We've been using osTicket for a few years and just started getting "Too many redirects" errors today trying to open osTicket. It's still accessible from a private browser window, but not a normal window. Multiple people started seeing this today, so it's not just one user's browser. It appears our hosting provider just upgraded PHP today to 8.2.18. I've seen some suggestions online that it could be something in the .htaccess file. Any ideas what I should look for?

LostMarble

I learned a little more. It only starts happening if a user follows a certain link: https://lostmarble.com/support/view.php?auth=o1xeqaaaaczaaaaafNhdV%2Byn9%2Bd8vg%3D%3D

Once you do that, then our osTicket stops working in that browser. If you delete cookies, it starts working again. Weird...

KevinTheJedi

LostMarble

Post a screenshot of Admin Panel > Dashboard > Information.

Cheers.

LostMarble

It turns out that this didn't start when PHP was updated, it actually started a couple days before that.

KevinTheJedi

LostMarble

That is very strange indeed. Your prerequisites all look fine. Apache shouldn't be causing "too many redirects" as it's going to a single file that would only redirect to one place (either index.php/login.php if failed or ticket.php?id=xxx if successful). I would TRUNCATE the _session table, have everyone clear their browser sessions/cookies, and retest. Also you can try restarting your webserver, etc.

Do you have any other sites or anything running that could be affecting this? Browser plugins, firewall, etc.?

Cheers.

LostMarble

Our users are external, not like coworkers internal to a company. So I can't really say what all plugins and firewalls they might have in place. I know it's happening for multiple people and myself I can reproduce it on Mac, Windows, and iPhone in multiple browsers. I have some ad blocking plugins, but it happens with them all turned off too. I'll look into the _session table.

As far as the "single file that would only redirect to one place" can you point me to that? I'm curious to take a look.

LostMarble

I tried TRUNCATE on the _session table. At first this seemed to fix the issue, but only until I visited a URL in this form again:

https://lostmarble.com/support/view.php?auth=o1xeqaaaaczaaaaafNhdV%2Byn9%2Bd8vg%3D%3D

Then the problem comes back with "too many redirects"

KevinTheJedi

LostMarble

Is it an HTTP -> HTTPS loop? Check the server logs to see what it’s looping to. We know view.php but what is that redirecting to?

Cheers.

mirkt

Hello,

After updating to v1.18.2, our users keep encountering the "ERR_TOO_MANY_REDIRECTS" issue. So far, I haven't figured out when exactly this happens. Sometimes, a person creates several tickets in a day, and then it stops working.

Clearing cookies in the browser helps. But today, there was a case where, after clearing the cookies, the issue returned for the same person after an hour.

This happens for both users registering issues and staff who log in to /scp/

One more thing to note: both users registering issues and staff authenticate via LDAP.

Any ideas?

Thanks in advance

KevinTheJedi

mirkt

I would try updating PHP and retesting or something. Also, see if someone not using LDAP can replicate the issue. We cannot replicate this with our production systems.

Cheers.

mirkt

Hello, do you have any thoughts/suggestions on how to debug this issue?

KevinTheJedi

mirkt

Read my reply above.

Cheers.

mirkt

Hello,

It looks that when "too many redirects" issue occurs CSRFToken error is logged..

KevinTheJedi

mirkt

... see if someone not using LDAP can replicate the issue. We cannot replicate this with our production systems.

mirkt

Hello, all our users and agents are using LDAP. I could try to make one or several users local, but the problem is that I don't know how to replicate the issue, as it only occurs for some users and not consistently. Last week I turned off:

and since then, we haven't received any complaints (no errors regarding CSRF Token in logs as well). I hope it will remain this way 🙂

mirkt

Unfortunately, today one user complained about the same issue. I no longer see any CSRF token errors, but in the Apache logs, I can see that the user is being constantly redirected, then successfully authenticated (the correct username is visible in the log), after which the process repeats, continuing until the loop is interrupted.
192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 1012 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 929 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 925 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 925 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 931 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 921 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 923 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 921 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 927 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 925 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 923 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" ::1 - - [09/Apr/2025:07:56:01 +0300] "OPTIONS * HTTP/1.0" 200 110 "-" "Apache/2.4.62 (Debian) mod_auth_gssapi/1.6.4 OpenSSL/3.0.15 (internal dummy connection)" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 923 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 921 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 929 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 927 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 921 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 917 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 925 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 925 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:01 +0300] "GET /open.php HTTP/1.1" 302 925 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - - [09/Apr/2025:07:56:02 +0300] "GET /open.php HTTP/1.1" 401 692 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 192.168.CEN.CEN - real_username_removed [09/Apr/2025:07:56:02 +0300] "GET /open.php HTTP/1.1" 302 919 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"

In the user audit log, it is visible that they are repeatedly being logged in.

Do you have any suggestions on how to enable debugging so that I can determine the cause of the redirection?

Thanks

KevinTheJedi

mirkt

Try deleting the session/cookies/cache and retry. If that doesn't work try an entirely different browser. If that works then your other browser and/or your webserver and/or the database is hard-caching their session/cookies.

Cheers.

mirkt

deleting browser cookies (OSTSESSID) – helps
truncating "session" table in DB – helps
.. until it stops working again occasionally..

not sure about "webserver" you mentioned

KevinTheJedi

mirkt

So if deleting the session works then it seems like your sessions are getting borked somehow. Try to track down a cause like browser extensions, device, network, server settings, etc.

Cheers.