# SSO redirect loop

**URL:** <https://meta.discourse.org/t/sso-redirect-loop/117898>\
**Category:** Product Support\
**Created:** [16 במאי,‏ 2019,‏ 8:45am UTC](https://meta.discourse.org/t/sso-redirect-loop/117898 "2019-05-16T08:45:21Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![nikod](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@nikod](https://meta.discourse.org/u/nikod)\
**Post date:** [16 במאי,‏ 2019,‏ 8:45am UTC](https://meta.discourse.org/t/sso-redirect-loop/117898/1 "2019-05-16T08:45:21Z")

</div>

Hey there,

we’re using Discourse [v2.3.0.beta2 +130] with SSO. For a few months now (sorry that I can’t pinpoint the exact update that caused the issue) collegues are reporting SSO redirect loops (followed by 429 errors which is ok) when clicking on discourse links in webmail clients. This only happens, if one is already logged in. We can reproduce in Firefox and Chrome on Windows and Linux. Steps to reproduce:

- When logged out of discourse (all cookies cleaned etc)
- Click on a Disourse link in Gmail or Zimbra
- A new tab opens with the Discourse URL
- After getting redirected to our SSO login enter your credencials
- You get successfully logged in
- Click on another Discourse link in Gmail or Zimbra
- A new tab opens with the Discourse URL
- You get redirected to the SSO login
- Then you get redirected back to Disrourse with the token in the URL
- Then Discourse redirects you back to the SSO login
- and so on …

Strangly this doesn’t happen if the link is copy/pasted instead of clicked on. This strikes me as weird.

These are the URLs in the loop

- `https:// forum.our.tld/`
- `https:// forum.our.tld/session/sso`
- `https:// sso.our.tld/sso/discourse?sso=bm9u…%3D%3D&sig=3944…`
- `https:// forum.our.tld/session/sso_login?sso=bm9uY…1B%0AbmRyZWFz…Vhc19sYXV0X…JTQwZ2…dHAlM0ElMkYl…BBKitodHRw…pdG9y…rJTI4ZW…Vu%0AZGUr…9fdXJs%0APWh0…Nlc3Npb2…3D%0A&sig=13f4…`

I found similar topics here but none of them is matching my exact problem:

- We have HTTPS everywhere, so it’s probably not related to [SSO Loop - Help needed to find the problem](https://meta.discourse.org/t/sso-loop-help-needed-to-find-the-problem/78214). We do SSL termination in Haproxy in front of Discourse.
- It’s not a Safari thing, so it’s not related to [Infinite SSO redirect on Safari](https://meta.discourse.org/t/infinite-sso-redirect-on-safari/110857).

Any ideas what might be wrong here?

---

_[View the full topic](https://meta.discourse.org/t/sso-redirect-loop/117898)._