<p>This was a <a href="https://www.modsecurity.org/" rel="nofollow">ModSecurity</a> rule tripping up the request and causing an infinite redirect loop.</p>

<p>I don't know which rule it was exactly, but disabling ModSecurity resolved the issue.</p>

CC BY-SA 3.0
2016-08-16T22:20:50.500Z
Thank you Brad, it appears to have triggered rules: `973337: XSS Filter - Category 2: Event Handler Vector` and `981246: Detects basic SQL authentication bypass attempts 3/3`. I have reported this to cPanel for wrongly triggering with Craft.
William Isted
CC BY-SA 3.0
2016-08-18T12:26:41.477Z
`ModSec` is such a pain. Rule `981243: Detects classic SQL injection probings 2/2` has begun causing the redirect issue as well.
William Isted
CC BY-SA 3.0
2016-08-18T15:54:38.020Z
IMO things like ModSec and Suhosin are generally more pain than they're worth.
Brad Bell
CC BY-SA 3.0
2016-08-18T20:01:55.990Z
Agreed. Disabled it's SQL Injection filters, one more problem out of it, and it's being nuked.
William Isted
CC BY-SA 3.0
2016-08-16T21:33:58.097Z
2016-08-16T21:33:58.097Z
Brad Bell
<p>I'm experiencing weird cookie/redirect issues after logging in the admin/cp. Keeps redirecting to / (even on /) untill I've deleted my cookies. </p>

<p>Clean download/install, no errors occured. I have no idea what to check:</p>

<ul>
<li>clean download of latest version 2.4.2700, no changes</li>
<li>different domain/hosting tested, still redirect occurs</li>
<li>different browsers tested, same results</li>
</ul>

<p>Pulling my hair out here, any suggestions/ideas?</p>

<p>-- edit
It has to be a cookie/session related issue, but all paths are 'normal'. Using CentOS with cPanel, all up to date</p>

CC BY-SA 3.0
2015-10-28T15:20:02.387Z
Have you made changes to the htaccess file?
a-am
CC BY-SA 3.0
2015-10-28T15:26:45.737Z
No, we even removed the .htaccess to make sure that wasn't the issue. Using the index.php gives no other result unfortunately :(
Chris
CC BY-SA 3.0
2015-10-28T15:29:45.267Z
Are you using any caching like Varnish/Cloudflare/PHP opcache/APC/etc?
Brad Bell
CC BY-SA 3.0
2015-10-28T15:48:17.513Z
Nope, no caching server/service is being used
Chris
CC BY-SA 3.0
2015-10-28T15:56:44.910Z
Did this happen from initially installing?  If not could it be a plugin dashboard widget issue?
a-am
CC BY-SA 3.0
2015-10-28T16:56:22.067Z
If you want to send some CP/FTP credentials over to support@buildwithcraft.com, we can take a stab at it and update here with any results.
Brad Bell
<control-panel><redirect><loop>
Craft redirect loop after logging in
# Craft redirect loop after logging in

(Asked by: username_0 on 2015-10-28)

I'm experiencing weird cookie/redirect issues after logging in the admin/cp. Keeps redirecting to / (even on /) untill I've deleted my cookies.

Clean download/install, no errors occured. I have no idea what to check:

* clean download of latest version 2.4.2700, no changes
* different domain/hosting tested, still redirect occurs
* different browsers tested, same results

Pulling my hair out here, any suggestions/ideas?

-- edit
It has to be a cookie/session related issue, but all paths are 'normal'. Using CentOS with cPanel, all up to date

**Tags:** control-panel, redirect, loop

> **Comments:**
> **username_1**: Have you made changes to the htaccess file?  
> **username_0**: No, we even removed the .htaccess to make sure that wasn't the issue. Using the index.php gives no other result unfortunately :(  
> **username_2**: Are you using any caching like Varnish/Cloudflare/PHP opcache/APC/etc?  
> **username_0**: Nope, no caching server/service is being used  
> **username_1**: Did this happen from initially installing?  If not could it be a plugin dashboard widget issue?  
> **username_2**: If you want to send some CP/FTP credentials over to support@buildwithcraft.com, we can take a stab at it and update here with any results.  

---

## 1 answers

### Answer by username_2 on 2016-08-16. Score: 1

This was a [ModSecurity](https://www.modsecurity.org/) rule tripping up the request and causing an infinite redirect loop.

I don't know which rule it was exactly, but disabling ModSecurity resolved the issue.

> **Comments:**
> **username_3**: Thank you Brad, it appears to have triggered rules: `973337: XSS Filter - Category 2: Event Handler Vector` and `981246: Detects basic SQL authentication bypass attempts 3/3`. I have reported this to cPanel for wrongly triggering with Craft.  
> **username_3**: `ModSec` is such a pain. Rule `981243: Detects classic SQL injection probings 2/2` has begun causing the redirect issue as well.  
> **username_2**: IMO things like ModSec and Suhosin are generally more pain than they're worth.  
> **username_3**: Agreed. Disabled it's SQL Injection filters, one more problem out of it, and it's being nuked.  

---

