10

I host a small web site at an external host provider. When I open it from my iPhone, I get different results depending on how my iPhone is connected to the internet:

  • When connection is made through WiFi, my page always opens and runs as expected
  • When connection is made through Cellular, my page always produces the following error message:

On mobile Safari:

Safari cannot open the page because too many redirects occurred.

On mobile Chrome:

This page isn't working / redirected you too many times.

On mobile Opera:

This site can't be reached / too many HTTP redirects.

As far as I can tell, the only difference that decides the outcome is the internet connection type - WiFi vs. Cellular. I cannot find any other differences.

Since the site works fine through WiFi network, I ruled out a redirect loop on my site (that is the most commonly mentioned cause of "too many redirects" error). I also tried turning off cross-site tracking prevention, but the results remained the same. Am I missing something? What could be the cause of this strange behavior?

In case it is relevant, here are a few things about the web site itself:

  • Web site is developed with ASP.NET Core
  • I access site using https in both cases (via WiFi and via Cellular)
  • Site is on a subdomain, which uses a wildcard certificate from the "top" domain
  • Site uses ASP.NET Core "scaffold-ed" authentication, which uses redirects and cookies, and has "remember me" functionality.
Sergey Kalinichenko
  • 714,442
  • 84
  • 1,110
  • 1,523
  • Strange. Maybe try Settings > Safari > Clear History and Website Data? I’m wondering if it’s something to do with different cache behaviours between cellular and wifi. – Peter Parker Feb 22 '20 at 21:17
  • @PeterParker I did fresh install of Chrome and Opera, which I never had on my phone before. Unfortunately, I did not have any luck with that. – Sergey Kalinichenko Feb 22 '20 at 22:05
  • Can you test the differences between the requests that you receive at the server? Print the http headers, parameters etc. Do you support/use HTTP/2? – Jannes Botis Feb 24 '20 at 21:36
  • Seems like a little old bug. Check https://stackoverflow.com/q/35519511/7183675, https://stackoverflow.com/q/25600332/7183675 and https://stackoverflow.com/q/25064937/7183675 – Adam Tucholski Feb 27 '20 at 10:22
  • Can you give url if that is not confidential? – Asfar Irshad Feb 27 '20 at 13:22
  • 2
    @AsfarIrshad Thank you very much for your help. I found a fix almost by accident, and I posted it below. It had to do with out-of-process hosting mode and a redirect on the server. – Sergey Kalinichenko Feb 27 '20 at 15:29

5 Answers5

3

I finally stumbled upon a fix, although I still do not know why the error does not manifest itself on desktops and mobile WiFi connections. The issue has to do with hosting my web application on IIS using out-of-process mode, and calling UseHttpsRedirection() during the setup.

What happens next is described in this answer: IIS, which connects to my out-of-process host (Kestrel) via http, gets redirected, and the browser on my phone somehow detects it. There is also a second redirection (the legitimate one) to the login page, which the phone browser counts as well. Now the phone browser sees two redirections, so it displays an error, because at most one redirection is allowed.

The fix was simply to remove the call to UseHttpsRedirection(). It was unnecessary in out-of-process hosting scenario: IIS front is configured to require https, so clients get redirected anyway.

Sergey Kalinichenko
  • 714,442
  • 84
  • 1,110
  • 1,523
  • My best guess would be HSTS. Once the header has been sent, supporting clients will no longer allow HTTP at all. Then, it would probably be down to a proxy/cache issue on one network versus the other. There's nothing that would directly explain a difference here based on network, so it's probably a confluence of things. It would be interesting to see if a different iPhone also had the same issue. – Chris Pratt Feb 27 '20 at 15:46
  • @ChrisPratt I've tried this from nearly every iPhone I could get my hands on, and I always got the same problem. HSTS is, indeed, configured, so I'll try this from a "fresh" device to see if I get a redirect. Once again, thank you very much for your help. – Sergey Kalinichenko Feb 27 '20 at 16:45
2

Doing application side https forcing behind a reverse proxy is tricky. Generally it is better to let the reverse proxy do the forcing, and set the proxy to communicate on https only to avoid any application side forcing. (If the application has https capabilities of course)

If you must do it from the application, then the proxy must include the necessary headers for the application to evaluate the original connection context. And it may have to know the original hostname and basepath if you rewrite that.

Please review the instructions for asp.net core Forwarded Headers Middleware. https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer

As to why that behaves differently depending on your type of internet connection is a bit of a mystery.

Gerrit
  • 861
  • 6
  • 11
0

Try adding the line below to your Web.Config file. Seems like it could have to do with how mobile networks try and compress your packets as they're sent back to the device.

<system.webServer>
   <httpProtocol>
     <customHeaders>
     <add name="Cache-Control" value="no-transform" />
     </customHeaders>
   </httpProtocol>
</system.webServer>

which I believe is the equivalent of adding Header set Cache-Control "no-transform" to your .htaccess file.

If that doesn't work, try adding the following to all pages that should normally be touched during the request.

<% @Language="VBScript" %>
<% Response.CacheControl = "no-transform" %>

NOTE: This code must be inserted at the beginning of the page, unless buffering is enabled, because it is modifying the HTTP headers.

Eric Lang
  • 41
  • 6
  • The same browser lets me connect to the site when I connect to the network via WiFi, though, so a single redirect policy should apply regardless of how I connect, right? – Sergey Kalinichenko Feb 21 '20 at 18:21
  • Yes, I've tried this on four different WiFi networks, and on multiple cell phones using different providers. The results were always the same. – Sergey Kalinichenko Feb 21 '20 at 19:20
  • Adding this to web.config on my IIS server did not have any effect on the behavior of the site. – Sergey Kalinichenko Feb 21 '20 at 20:26
  • I did. It does not look like anything I can put anywhere on my Razor page without getting an error, though. – Sergey Kalinichenko Feb 24 '20 at 19:23
  • @dasblinkenlight https://andrewlock.net/adding-cache-control-headers-to-static-files-in-asp-net-core/ I've never worked with Razor pages, but this article seems to shine a light on how to add a cache-control directive to the page. – Eric Lang Feb 25 '20 at 14:14
0

It might be caused by browsers not getting correct content-type

Can you add this to your head in the view or layout(if you are using)

<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
</head>
Asfar Irshad
  • 658
  • 1
  • 4
  • 20
0

I think your service provider is using an apache server . if yes then please reset .htacess file (it is server configuration file used to controling server settings including redirects).

Vivek Anand
  • 1,264
  • 8
  • 15