CODEWITHSUNDEEP
phpapachehttp-redirectcookiesjoomla
Chris
Chris

Reputation: 27609

Server entering redirect loop due to "bad" cookie value

I have a situation that an Apache web server running a site on Joomla/php is managing to get itself into a redirect loop.

When visiting http://www.example.com/ it is issuing a 302 redirect to http://www.example.com/ (yes, the same url).

After some investigation we narrowed it down to the fact that there is a cookie with a value that it doesn't like...

The cookie contents is:

%7B%22distinct_id%22%3A%20%22vp37vv%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D

To save you the trouble that is urlencoded and decodes to:

{"distinct_id": "vp37vv","$initial_referrer": "$direct","$initial_referring_domain": "$direct"}

My guess was that there was some kind of "security" check going on, that it was looking at the cookie, not liking what it saw there and doing the redirect in misguided attempt to get rid of the bad value.

I noticed that if I put that cookie value in the url then it did a similar redirect. That is going to:

http://www.example.com/?c=%7B%22distinct_id%22%3A%20%22vp37vv%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D

resulted in it redirecting to http://www.example.com/ (ie it successfully got rid of the value it didn't like). Testing with a "safe" querystring value did not cause the redirect.

So to the question: What could be causing this and what can I do to stop it from happening?

Changing the cookie in any way is not an option since it is part of third party software - I need to make the server accept this cookie's existence.

My guess is that this is a php safety feature but if that is the case then I'm having trouble finding any documentation about it.

Upvotes: 1

Views: 190

Answers (1)

itoctopus
itoctopus

Reputation: 4251

There are a couple of things that may be causing this problem:

  • A Joomla security plugin (check to see if you have non-core Joomla security plugins installed on the server)
  • A ModSecurity Rule (or another firewall rule) being triggered. If that's the case, then you will need to whitelist that rule (check this post on how to whitelist a ModSecurity rule).

I suspect the latter.

Upvotes: 1

Related Questions