Open website on mobile device - Too many redirect

[wbonekamp]

Description of bug

When I open the website on a mobile device (android/ios) I get the error: too many redirects.
This only occurs with the site alias that is not the primary.
In my case the www.website.nl doesn't work but the website.nl (without www) does work.

I found out the problem is in the Site Alias Mapping Mode "Cannonical". When you use "Redirect" the problem doesn't exists.

Steps to reproduce

List the precise steps to reproduce the bug:

1. Browse the website om a mobile device
2. go to website.nl and www.website.nl
3. one of the urls won't work
4. See error: too many redirects

The problem only occurs om mobile devices!! on a desktop browser it works as expected

Affected version

• 09.06.02

Affected browser

Mobile brwoser!

• Chrome
• Firefox
• Safari

[valadas]

I have moved this issue to a discussion as this is probably not a Dnn issue or something that can be reproduced only with the steps provided.

In most cases this is caused by IIS redirect rules or some other external mechanism, can you check:

1. The web.config for redirect rules
2. If you are using a control panel, some put in place rules to enforce or strip www
3. If you are behind some sort of proxy, it may do a redirect too

[wbonekamp]

no proxy but we have some rules in the web.config for the https redirect

We are using these rules for years now and never had problems with "too many redirects"

[valadas]

Can you try not specifying the domain name but using {HTTP_HOST} instead, something like this article https://www.namecheap.com/support/knowledgebase/article.aspx/9953/38/iis-redirect-http-to-https

[tpperlman]

I am experiencing this too on a multi-portal site, see #4148

I do have one redirect rule to HTTPS which shouldn't have an impact on this:

        <rule name="RedirectHTTPS" stopProcessing="true" enabled="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" />
        </rule>

At the very least, a way to disable mobile detection would be great since we never use it on responsive sites.

[mitchelsellers]

I strongly recommend not using IIS Redirects in this manner for this.

[tpperlman]

Hi @mitchelsellers. I have had dozens of sites setup this way for many years and have never experienced this problem.

How else would you suggest we redirect all traffic to HTTPS, if it even has anything to do with the issue?

[tpperlman]

@mitchelsellers I was under the impression that each tab in the site would need to have the "Secure Connection" set on before the "SSL Enforced" option had any affect. Each tab in my sites have that set to off by default.

If this isn't the case then the help in the UI for "SSL Enforced" is incorrect when it states, "Check the box if unsecure pages will not be accessible with SSL (HTTPS)."

I am also not comfortable with an admin inadvertently disabling HTTPS, and like to lock it down in the web.config.

[mitchelsellers]

@tpperlman At this time, yes, that is a limitation. But Introducing IIS Redirect plus DNN Redirects can result in endless loops, unreachable sites, and undesired edit behavior.

[bdukes]

We use the same rewrite rule as @tpperlman and have never had any issue, FWIW.

[tpperlman]

@mitchelsellers I am not comfortable with users potentially forgetting to set the "Secure Connection" on every tab, so that doesn't appear to be a workable solution until there is a site-wide setting to enforce SSL, which would do the same as the IIS rewrite rule.

I have never relied on SSL settings in DNN, so that wouldn't have anything to do with this unless there is a bug in the code somewhere. But I am running a number of DNN 9.6.2 sites with SSL without issue.

[mitchelsellers]

There have been issues with Modules/Caching/URLs in situations depending on aliases before. Might not be the issue here, but it is something that has caused issues in the past, just an observation

[patrickryan79]

I ran into this the other day and prematurely commented, later removing it. I wanted to do some more investigating. I had canonical setup in the portal alias settings and had three portal aliases listed from initial setup (localhost, dev.mysite.com, mysite.com), all of which were also in IIS bindings for the site, with zero redirects setup in web.config. If I tried to load the site on mobile, or even with developer tools to simulate mobile, causing the dnnisMobile in the request (forgot what it was called exactly) the error response was "invalid portal requested" and caused too many redirects error. A quick look at fiddler didn't show any jumping from http to https or any other abnormality that I could spot.

The only way to prevent this was to make sure that the portal that's being requested matches the primary alias, and this only happens on mobile.

Sorry for not-so-great info, but got sidetracked and wasn't able to give it more then a few to look into it but seeing activity on here I wanted to share. I'll try to

Version: DNN 9.7.2
SSL: Yes

[patrickryan79]

set-cookie: dnn_IsMobile=True; path=/; HttpOnly
set-cookie: language=en-US; path=/; HttpOnly
set-cookie: dnn_IsMobile=True; path=/; HttpOnly
set-cookie: language=en-US; path=/; HttpOnly
status: 301
x-frame-options: SAMEORIGIN
x-redirect-reason: Wrong Portal Alias Requested
x-xss-protection: 1; mode=block

[tpperlman]

@patrickryan79 that is the same issue I documented in my original ticket at #4148

[patrickryan79]

I can reproduce at will. Seems to be related to the mobile request headers.

[tpperlman]

@patrickryan79 same here, I just go into developer tools in Chrome and switch to mobile view to view all the headers/responses. Weird thing is it only happens in Chrome and Edge Chromium. No problem in Firefox Android.

[valadas]

For those who can actually reproduce this issue, can you guys try to setup a clean new site with a similar setup and still make it happen:

If so, please provide a step by step so we can debug this.

If not, then you need to start looking at what might be configured differently, I am thinking friendly url settings here maybe...

[patrickryan79]

Sure @valadas. I'll do it now.

[patrickryan79]

Here you go @valadas.

Steps to reproduce in a local environment.

1. Edit hosts file and add two domains pointing to 127.0.0.1 (e.g. mobiletest.com, sub.mobiletest.com)
2. Setup site files and configure in IIS, adding the two bindings for mobiletest.com, sub.mobiletest.com
3. Install DNN (I used 9.7.2) by loading mobiletest.com
4. Add sub.mobiletest.com as portal alias
5. Leave all other settings as default
6. Using Chrome, test the second alias
7. With developer tools, trigger mobile view and reload

Worth mentioning here that there is no SSL certificate, no redirects, etc.

[valadas]

Thank you, I can reproduce and will investigate 👍

[valadas]

Now that we have steps to reproduce, I created an issue for it #4157

I'll be investigating this shortly...