Infinite redirections if field "Home page url" is used in new settings tab

Gitlab 7.7 introduced a new settings tab corresponding to the previous gitlab.yml config file.

That tab contains a field "Home page url" where I entered the home page of our forge http://our.forge.com/

Entering such URL just prevents people for connecting the forge with infinite redirections.

I believe it is because logging requires people to go to https://our.forge.com/users/signin and because the user is not logged, it is always redirected to https://our.forge.com/, which in turns redirect to https://our.forge.com/users/signin and so on ...

I was hit by this too. Workaround is to enter the psql application and update the settings in the db.

My own workaround was to simply remove the value of that field and save the settings. It worked fine.

I logged out to test whatever redirect I had made.. Couldn't log back in :P

If you go directly to https://your.forge.com/users/signin you should be able to log in.

mentioned in issue #1029 (closed)

Then... isn't this working as expected? When you're not logged in and try to visit the url you are redirected to your Home page. If you want to login you need to use the direct link to the login page.

That's what this setting intends to do right? If not, please explain it to me as i obviously didn't understand then.

The problem is that with the current implementation, you see no page: your browser is going to tell you that there are too many redirection to show you a page.

That problem occurs for each page if you are not logged in but the /users/signin page.

This is obviously not the expected way it should work :)

The usual redirection to /users/signin from all page when the user is not logged in should be disabled if a custom URL is given on the settings page.

hmm i just tried to reproduce this on my dev setup and failed. I ony get redirected to the set homepage if i call http://localhost:3000 while i'm not logged in.
On other pages like this
http://localhost:3000/gitlab-org/gitlab-test/
I get redirected to the login page.

On my setup, http redirects to https (nginx configuration). Maybe the issue is that the redirection is made using http, not https?

I too have an HTTPS proxy in front of it which redirects HTTP to HTTPS. Could be a hint.

mentioned in issue #1029 (closed)

I'm also using a HTTPS proxy with apache. Nginx is disabled. I used this apache config: https://gitlab.com/gitlab-org/gitlab-recipes/blob/master/web-server/apache/gitlab-ssl-apache2.4.conf

I'm experiencing this too with Gitlab CE 7.11.4, with HTTP redirecting to HTTPS with nginx config.

I am able to reproduce this on 8.0.3 locally. Behavior is as expected if the user is not signed in. However, on sign in there is an infinite loop if the GitLab sign-in button is used. I believe this is because the URL has ?redirect_to_referer=yes when the sign-in button is used. If I remove this the loop is gone.

Steps to reproduce:

1. Configure 'Home Page URL' in Admin Area -> Settings. Even if this is some external URL like yahoo.com the bug is reproducible.
2. Sign out
3. Visit a URL that will not redirect to the Home Page URL, such as /explore.
4. Click the Sign In button.
5. Sign in and observe the infinite redirect loop.
6. Remove ?redirect_to_referer=yes from the URL and observe that GitLab functions as normal.

Customer reported: https://gitlab.zendesk.com/agent/tickets/9355

cc/ @JobV @dzaporozhets

This may be related to !1505 (merged).

Also note that fc66e1cc should prevent users from accidentally causing a endless redirection if Home page URL is used.

@stanhu Unfortunately !1505 (merged) did not fix the issue nor did fc66e1cc help. I'm able to reproduce the issue on 8.0.4 as is the customer. It seems to be related to the redirect_to_referer=yes parameter in the URL.

cc/ @dzaporozhets @JobV

This is blocking user from upgrading in https://gitlab.zendesk.com/agent/tickets/9355

This is reproducible on GitLab.com but not if you have 2FA enabled. On redirect to the 2FA code page to redirect_to_referer parameter is lost.

@dblessing @JobV we need to schedule it and fix.

ping @JobV

Milestone changed to 8.3

@JobV Can we schedule this sooner, please? This is really broken.

@dblessing we can try, but we're at max capacity already for 8.2. If you can make time yourself or if @dzaporozhets or @stanhu could help, that'd make it possible.

Milestone changed to 8.2

mentioned in merge request !1703 (merged)

@dblessing I agree with @JobV - lets try but keep in mind it can be delayed

@jvanbaarsen Has a merge request (!1703 (merged)) that looks good. We're waiting on a final test to pass and I think we can merge it.

Status changed to closed by merge request !1703 (merged)

mentioned in commit 82aa5419

mentioned in commit a76d4d27

I have the same issue in Gitlab 8.16.3, after changed the url from internal naming to external https public domain from outside resolve this in infinite redirection.

@bedotech If you've just started experiencing this with 8.16, please create a new issue and link here for reference. It may be a regression.

mentioned in issue #27583 (closed)