HTTP — too many redirects when fetching a URL
Diagnose redirect loops by tracing the Location chain and finding the mismatched rule that creates the cycle.
Symptoms
- Too many redirects or redirect loop detected
- curl reports a redirect chain that revisits a URL
- HTTP-to-HTTPS redirect bounces back to HTTP
- A login page redirects to itself
Possible causes
- An HTTP-to-HTTPS redirect loops back to HTTP
- Proxy rules rewrite the same request repeatedly
- A trailing slash rule conflicts with another rule
- Auth middleware redirects unauthenticated requests to a page that also requires auth
Diagnosis steps
Follow the chain and read each Location
curl -sIL http://host/path | grep -i "^location\|^HTTP"Interpretation
The sequence shows where the loop starts, for example an HTTP URL redirecting to itself after a hop.
Check proxy and rewrite rules
nginx -T 2>/dev/null | grep -i "rewrite\|return 30\|proxy_pass"Interpretation
Conflicting rewrite rules or a wrong scheme in proxy_pass create cycles.
Inspect the app auth logic
grep -rn "redirect\|Location" src | grep -i "auth\|login"Interpretation
An auth guard that redirects to a protected page loops forever.
Root cause
A redirect chain returned to a URL already visited because rules rewrote the request back to its origin or an auth guard redirected to another protected page.
Fix
Fix the redirect rule so each hop moves forward, correct the scheme and host in proxy configuration, and exempt the login path from the auth redirect so it does not loop on itself.
Verify the fix
Request the URL again and confirm the chain terminates at a 200, and confirm the final URL is the intended destination.
Symptom walkthrough
Fetching a URL fails with too many redirects, and following the chain shows the same URL appearing repeatedly. The loop is usually created by conflicting rules: an HTTP-to-HTTPS redirect that the proxy sends back to HTTP, a trailing-slash rule fighting another rule, or an authentication middleware redirecting a request to a page that also requires authentication, so each hop leads back to a protected URL.
Fix in practice
Trace the Location chain to the first repeated URL, then fix that rule so each redirect advances the request. Correct scheme and host in proxy configuration, and always exempt the login or error path from the auth redirect so it can terminate instead of looping.
Verification
Request the URL again and confirm the chain ends at a 200 response, then confirm the final URL is the intended one. A terminating chain with the right destination confirms the loop is broken.
Diagnostic commands
Check the behavior with commands like these:
curl -sIL http://host/path | grep -i "^location\|^HTTP"
nginx -T 2>/dev/null | grep -i "rewrite\|return 30\|proxy_pass"
grep -rn "redirect\|Location" src | grep -i "auth\|login"