Resource with no domain causes endless redirect loop #1172

New Issue

MrUnknownDE · 2026-04-05T18:26:59+02:00

MrUnknownDE commented

2026-04-05 18:26:59 +02:00

Originally created by @srgustafson8 on 7/27/2025

Running v1.7.3, recently upgraded from v1.5.x
Docker Compose running on AWS Lightsail

I triggered a strange error today where I created a new resource but never selected/added the domain as below:

The resource creates successfully, but then causes the app go into a redirect loop - any request made goes into a loop like this (real url obfuscated)

https://pangolin.url/auth/resource/14?redirect=https%3A%2F%2Fpangolin.url%2Fauth%2Fresource%2F14%3Fredirect%3Dhttps%253A%252F%252Fpangolin.url%252Fauth%252Fresource%252F14%253Fredirect%253Dhttps%25253A%25252F%25252Fpangolin.url%25252Fauth%25252Fresource%25252F14%25253Fredirect%25253Dhttps%2525253A%2525252F%2525252Fpangolin.url%2525252Fauth%2525252Fresource%2525252F14%2525253Fredirect%2525253Dhttps%252525253A%252525252F%252525252Fpangolin.url%252525252Fauth%252525252Fresource%252525252F14%252525253Fredirect%252525253Dhttps%25252525253A%25252525252F%25252525252Fpangolin.url%25252525252Fauth%25252525252Fresource%25252525252F14%25252525253Fredirect%25252525253Dhttps%2525252525253A%2525252525252F%2525252525252Fpangolin.url%2525252525252Fauth%2525252525252Fresource%2525252525252F14%2525252525253Fredirect%2525252525253Dhttps%252525252525253A%252525252525252F%252525252525252Fpangolin.url%252525252525252Fauth%252525252525252Fresource%252525252525252F14%252525252525253Fredirect%252525252525253Dhttps%25252525252525253A%25252525252525252F%25252525252525252Fpangolin.url%25252525252525252Fauth%25252525252525252Fresource%25252525252525252F14%25252525252525253Fredirect%25252525252525253Dhttps%2525252525252525253A%2525252525252525252F%2525252525252525252Fpangolin.url%2525252525252525252Fauth%2525252525252525252Fresource%2525252525252525252F14%2525252525252525253Fredirect%2525252525252525253Dhttps%252525252525252525253A%252525252525252525252F%252525252525252525252Fpangolin.url%252525252525252525252Fauth%252525252525252525252Fresource%252525252525252525252F14%252525252525252525253Fredirect%252525252525252525253Dhttps%25252525252525252525253A%25252525252525252525252F%25252525252525252525252Fpangolin.url%25252525252525252525252Fauth%25252525252525252525252Fresource%25252525252525252525252F14%25252525252525252525253Fredirect%25252525252525252525253Dhttps%2525252525252525252525253A%2525252525252525252525252F%2525252525252525252525252Fpangolin.url%2525252525252525252525252Fauth%2525252525252525252525252Fresource%2525252525252525252525252F14%2525252525252525252525253Fredirect%2525252525252525252525253Dhttps%252525252525252525252525253A%252525252525252525252525252F%252525252525252525252525252Fpangolin.url%252525252525252525252525252Fauth%252525252525252525252525252Fresource%252525252525252525252525252F14%252525252525252525252525253Fredirect%252525252525252525252525253Dhttps%25252525252525252525252525253A%25252525252525252525252525252F%25252525252525252525252525252Fpangolin.url%25252525252525252525252525252Fauth%25252525252525252525252525252Fresource%25252525252525252525252525252F14%25252525252525252525252525253Fredirect%25252525252525252525252525253Dhttps%2525252525252525252525252525253A%2525252525252525252525252525252F%2525252525252525252525252525252Fpangolin.url%2525252525252525252525252525252Fauth%2525252525252525252525252525252Fresource%2525252525252525252525252525252F14%2525252525252525252525252525253Fredirect%2525252525252525252525252525253Dhttps%252525252525252525252525252525253A%252525252525252525252525252525252F%252525252525252525252525252525252Fpangolin.url%252525252525252525252525252525252Fauth%252525252525252525252525252525252Fresource%252525252525252525252525252525252F14%252525252525252525252525252525253Fredirect%252525252525252525252525252525253Dhttps%25252525252525252525252525252525253A%25252525252525252525252525252525252F%25252525252525252525252525252525252Fpangolin.url%25252525252525252525252525252525252Fauth%25252525252525252525252525252525252Fresource%25252525252525252525252525252525252F14%25252525252525252525252525252525253Fredirect%25252525252525252525252525252525253Dhttps%2525252525252525252525252525252525253A%2525252525252525252525252525252525252F%2525252525252525252525252525252525252Fpangolin.url%2525252525252525252525252525252525252Fauth%2525252525252525252525252525252525252Fresource%2525252525252525252525252525252525252F14%2525252525252525252525252525252525253Fred

Can't see anything in the logs relating to this. The only fix is to delete that resource from the database directly.

Should the domain control be mandatory? I believe the behaviour recently changed, so it is now relatively easy to enter a correct domain as below, but without it actually being selected:

vs

*Originally created by @srgustafson8 on 7/27/2025* Running v1.7.3, recently upgraded from v1.5.x Docker Compose running on AWS Lightsail I triggered a strange error today where I created a new resource but never selected/added the domain as below: <img width="530" height="248" alt="Image" src="https://github.com/user-attachments/assets/cbae75e3-f9c1-400a-b9e2-c1e271f35fc8" /> The resource creates successfully, but then causes the app go into a redirect loop - any request made goes into a loop like this (real url obfuscated) ```text https://pangolin.url/auth/resource/14?redirect=https%3A%2F%2Fpangolin.url%2Fauth%2Fresource%2F14%3Fredirect%3Dhttps%253A%252F%252Fpangolin.url%252Fauth%252Fresource%252F14%253Fredirect%253Dhttps%25253A%25252F%25252Fpangolin.url%25252Fauth%25252Fresource%25252F14%25253Fredirect%25253Dhttps%2525253A%2525252F%2525252Fpangolin.url%2525252Fauth%2525252Fresource%2525252F14%2525253Fredirect%2525253Dhttps%252525253A%252525252F%252525252Fpangolin.url%252525252Fauth%252525252Fresource%252525252F14%252525253Fredirect%252525253Dhttps%25252525253A%25252525252F%25252525252Fpangolin.url%25252525252Fauth%25252525252Fresource%25252525252F14%25252525253Fredirect%25252525253Dhttps%2525252525253A%2525252525252F%2525252525252Fpangolin.url%2525252525252Fauth%2525252525252Fresource%2525252525252F14%2525252525253Fredirect%2525252525253Dhttps%252525252525253A%252525252525252F%252525252525252Fpangolin.url%252525252525252Fauth%252525252525252Fresource%252525252525252F14%252525252525253Fredirect%252525252525253Dhttps%25252525252525253A%25252525252525252F%25252525252525252Fpangolin.url%25252525252525252Fauth%25252525252525252Fresource%25252525252525252F14%25252525252525253Fredirect%25252525252525253Dhttps%2525252525252525253A%2525252525252525252F%2525252525252525252Fpangolin.url%2525252525252525252Fauth%2525252525252525252Fresource%2525252525252525252F14%2525252525252525253Fredirect%2525252525252525253Dhttps%252525252525252525253A%252525252525252525252F%252525252525252525252Fpangolin.url%252525252525252525252Fauth%252525252525252525252Fresource%252525252525252525252F14%252525252525252525253Fredirect%252525252525252525253Dhttps%25252525252525252525253A%25252525252525252525252F%25252525252525252525252Fpangolin.url%25252525252525252525252Fauth%25252525252525252525252Fresource%25252525252525252525252F14%25252525252525252525253Fredirect%25252525252525252525253Dhttps%2525252525252525252525253A%2525252525252525252525252F%2525252525252525252525252Fpangolin.url%2525252525252525252525252Fauth%2525252525252525252525252Fresource%2525252525252525252525252F14%2525252525252525252525253Fredirect%2525252525252525252525253Dhttps%252525252525252525252525253A%252525252525252525252525252F%252525252525252525252525252Fpangolin.url%252525252525252525252525252Fauth%252525252525252525252525252Fresource%252525252525252525252525252F14%252525252525252525252525253Fredirect%252525252525252525252525253Dhttps%25252525252525252525252525253A%25252525252525252525252525252F%25252525252525252525252525252Fpangolin.url%25252525252525252525252525252Fauth%25252525252525252525252525252Fresource%25252525252525252525252525252F14%25252525252525252525252525253Fredirect%25252525252525252525252525253Dhttps%2525252525252525252525252525253A%2525252525252525252525252525252F%2525252525252525252525252525252Fpangolin.url%2525252525252525252525252525252Fauth%2525252525252525252525252525252Fresource%2525252525252525252525252525252F14%2525252525252525252525252525253Fredirect%2525252525252525252525252525253Dhttps%252525252525252525252525252525253A%252525252525252525252525252525252F%252525252525252525252525252525252Fpangolin.url%252525252525252525252525252525252Fauth%252525252525252525252525252525252Fresource%252525252525252525252525252525252F14%252525252525252525252525252525253Fredirect%252525252525252525252525252525253Dhttps%25252525252525252525252525252525253A%25252525252525252525252525252525252F%25252525252525252525252525252525252Fpangolin.url%25252525252525252525252525252525252Fauth%25252525252525252525252525252525252Fresource%25252525252525252525252525252525252F14%25252525252525252525252525252525253Fredirect%25252525252525252525252525252525253Dhttps%2525252525252525252525252525252525253A%2525252525252525252525252525252525252F%2525252525252525252525252525252525252Fpangolin.url%2525252525252525252525252525252525252Fauth%2525252525252525252525252525252525252Fresource%2525252525252525252525252525252525252F14%2525252525252525252525252525252525253Fred ``` Can't see anything in the logs relating to this. The only fix is to delete that resource from the database directly. Should the domain control be mandatory? I believe the behaviour recently changed, so it is now relatively easy to enter a correct domain as below, but without it actually being selected: <img width="777" height="246" alt="Image" src="https://github.com/user-attachments/assets/b98a59b3-ee6a-47af-82ef-014a668a7547" /> vs <img width="755" height="123" alt="Image" src="https://github.com/user-attachments/assets/6c0eb7b8-0772-4460-a2ba-f3e589f8795d" />

MrUnknownDE closed this issue

2026-04-05 18:26:59 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1172