Getting "Too many HTTP redirects" when attempting to file radars #89

ZevEisenberg · 2016-06-14T14:28:50Z

I'm assuming they made changes at WWDC 2016? Reproduced on two machines with two different developer accounts. It happens on the "Signing in to RadarWeb" step.

orta · 2016-06-16T00:57:05Z

I don't have the time to do a full PR, but running this in debug mode brings up this:

2016-06-15 17:56:03.107429 QuickRadar[10053:763605] Found no element //img[@id='alert_icon']/@src
2016-06-15 17:56:06.863055 QuickRadar[10053:761345] Failure by QRRadarSubmissionServiceIdentifier

Likely this is the change

keith · 2016-06-16T20:19:50Z

It looks like at this state the entire xmlDocument only contains this:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><title>Apple</title><meta http-equiv="REFRESH" content="0;URL=http://www.apple.com/filenotfound" /></head><body bgcolor="#FFFFFF"></body></html>

abbeycode · 2016-06-19T14:06:02Z

I'm getting this also.

orta · 2016-06-19T17:54:43Z

Digging in a bit further, now I'm back in NYC, this is the new re-direction path ( had to write a quick app ) - will see about wrapping this up and making a PR

2016-06-19 13:52:07.318 LinkChecker[6856:956926] action: {
    WebActionModifierFlagsKey = 0;
    WebActionNavigationTypeKey = 5;
    WebActionOriginalURLKey = "https://idmsa.apple.com/IDMSWebAuth/login.html?appIdKey=77e2a60d4bdfa6b7311c854a56505800be3c24e3a27a670098ff61b69fc5214b&sslEnabled=true&rv=3";
}
2016-06-19 13:52:32.895 LinkChecker[6856:956926] action: {
    WebActionButtonKey = 0;
    WebActionElementKey =     {
       ...
    };
    WebActionFormKey = "<DOMHTMLFormElement [FORM]: 0x10cbe3a80 ''>";
    WebActionModifierFlagsKey = 0;
    WebActionNavigationTypeKey = 1;
    WebActionOriginalURLKey = "https://idmsa.apple.com/IDMSWebAuth/authenticate;jsessionid=6A6F10E58CA810EC1D701A4C466351A1";
}
2016-06-19 13:52:33.444 LinkChecker[6856:956926] action: {
    WebActionButtonKey = 0;
    WebActionElementKey =     {
      ...
    };
    WebActionModifierFlagsKey = 0;
    WebActionNavigationTypeKey = 1;
    WebActionOriginalURLKey = "https://idmsa.apple.com/IDMSWebAuth/authenticate;jsessionid=6A6F10E58CA810EC1D701A4C466351A1";
}
2016-06-19 13:52:33.883 LinkChecker[6856:956926] action: {
    WebActionButtonKey = 0;
    WebActionElementKey =     {
    ...
    };
    WebActionModifierFlagsKey = 0;
    WebActionNavigationTypeKey = 1;
    WebActionOriginalURLKey = "https://idmsa.apple.com/IDMSWebAuth/authenticate;jsessionid=6A6F10E58CA810EC1D701A4C466351A1";
}
2016-06-19 13:52:34.278 LinkChecker[6856:956926] action: {
    WebActionButtonKey = 0;
    WebActionElementKey =     {
    ...
    };
    WebActionModifierFlagsKey = 0;
    WebActionNavigationTypeKey = 1;
    WebActionOriginalURLKey = "https://idmsa.apple.com/IDMSWebAuth/authenticate;jsessionid=6A6F10E58CA810EC1D701A4C466351A1";
}
2016-06-19 13:52:35.573 LinkChecker[6856:956926] action: {
    WebActionModifierFlagsKey = 0;
    WebActionNavigationTypeKey = 5;
    WebActionOriginalURLKey = "about:blank";
}

orta · 2016-06-20T19:29:27Z

I threw an hour or two at this before calling it for the evening, looks like in late may authentication changed:

I couldn't find the CRSF token in the new urls

steipete · 2016-06-20T23:40:20Z

Thanks for looking into this! Gotta love open source!

Also note this comment that hints on a undocumented radar JavaScript API that might be less fragile:
http://www.openradar.me/26886178

matej · 2016-06-23T13:35:07Z

After some digging around I managed to get the app running again. By deleting some code.

Specifically I removed the code that manually sets the Host field:

QuickRadar/QuickRadar/QRURLConnection.m

Line 131 in e63a16d

[request addValue:request.URL.host forHTTPHeaderField:@"Host"];
QuickRadar/QuickRadar/QRURLConnection.m

Line 141 in e63a16d

if (existingHeaders[@"Host"]) [orderedDict setObject:existingHeaders[@"Host"] forKey:@"Host"];

Doing that messes up the redirect we get after sending our authentication data, directing us to https://idmsa.apple.com/logon instead of https://bugreport.apple.com/logon.

I noticed this by comparing the reqests Safari and QuickRadar make during login.

Safari / request:

GET / HTTP/1.1
Host: bugreport.apple.com
DNT: 1
Cookie: <redacted>
Connection: keep-alive
Proxy-Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/601.6.17 (KHTML, like Gecko) Version/9.1.1 Safari/601.6.17
Accept-Language: en-us
Referer: https://idmsa.apple.com/IDMSWebAuth/login.html?appIdKey=77e2a60d4bdfa6b7311c854a56505800be3c24e3a27a670098ff61b69fc5214b&sslEnabled=true&rv=3
Accept-Encoding: gzip, deflate

Safari / respnse:

HTTP/1.1 302 Moved Temporarily
Date: Thu, 23 Jun 2016 12:24:14 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-API-Version: 1.8
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://bugreport.apple.com/logon
Content-Language: en-US
Content-Length: 0
Keep-Alive: timeout=15, max=4998
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1

QuickRadar / request:

GET / HTTP/1.1
Host: idmsa.apple.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: keep-alive
Accept-Language: en-us
Proxy-Connection: keep-alive
Cookie: <redacted>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/536.30.1 (KHTML, like Gecko) Version/6.0.5 Safari/536.30.1
Referer: https://idmsa.apple.com/IDMSWebAuth/login.html?appIdKey=77e2a60d4bdfa6b7311c854a56505800be3c24e3a27a670098ff61b69fc5214b&sslEnabled=true&rv=3
Accept-Encoding: gzip, deflate

QuickRadar / response:

HTTP/1.1 302 Moved Temporarily
Date: Thu, 23 Jun 2016 12:15:43 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-API-Version: 1.8
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: JSESSIONID=elPy-v0NpECJPBgkApiTfhci.nwk-radarp-lapp57; Path=/; Secure; HttpOnly
Location: https://idmsa.apple.com/logon
Content-Language: en-US
Content-Length: 0
Keep-Alive: timeout=15, max=5000
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1

Notice the difference for Host and Location.

I don't know the background here - why this has been done in the first place. But simply deleting those lines seems to do the trick for me. I can open up a PR for that, unless someone has a better idea.

amyworrall · 2016-06-23T13:38:14Z

If it works, I say go for it!

Most of the stuff QuickRadar sends just came from me observing a lot of sessions in Charles, and trying adding things until it worked. So this is exactly in keeping with the way the app has been built :)

Amy

On 23 Jun 2016, at 14:35, Matej Bukovinski notifications@github.com wrote:

After some digging around I managed to get the app running again. By deleting some code.

Specifically I removed the code that manually sets the Host field:

QuickRadar/QuickRadar/QRURLConnection.m

Line 131 in e63a16d

[request addValue:request.URL.host forHTTPHeaderField:@"Host"];

QuickRadar/QuickRadar/QRURLConnection.m

Line 131 in e63a16d

[request addValue:request.URL.host forHTTPHeaderField:@"Host"];

QuickRadar/QuickRadar/QRURLConnection.m

Line 141 in e63a16d

if (existingHeaders[@"Host"]) [orderedDict setObject:existingHeaders[@"Host"] forKey:@"Host"];

QuickRadar/QuickRadar/QRURLConnection.m

Line 141 in e63a16d

if (existingHeaders[@"Host"]) [orderedDict setObject:existingHeaders[@"Host"] forKey:@"Host"];

Doing that messes up the redirect we get after sending our authentication data, directing us to https://idmsa.apple.com/logon instead of https://bugreport.apple.com/logon.

I noticed this by comparing the reqests Safari and QuickRadar make during login.

Safari / request:

GET / HTTP/1.1
Host: bugreport.apple.com
DNT: 1
Cookie:
Connection: keep-alive
Proxy-Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/601.6.17 (KHTML, like Gecko) Version/9.1.1 Safari/601.6.17
Accept-Language: en-us
Referer: https://idmsa.apple.com/IDMSWebAuth/login.html?appIdKey=77e2a60d4bdfa6b7311c854a56505800be3c24e3a27a670098ff61b69fc5214b&sslEnabled=true&rv=3
Accept-Encoding: gzip, deflate
Safari / respnse:

HTTP/1.1 302 Moved Temporarily
Date: Thu, 23 Jun 2016 12:24:14 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-API-Version: 1.8
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://bugreport.apple.com/logon
Content-Language: en-US
Content-Length: 0
Keep-Alive: timeout=15, max=4998
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
QuickRadar / request:

GET / HTTP/1.1
Host: idmsa.apple.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Connection: keep-alive
Accept-Language: en-us
Proxy-Connection: keep-alive
Cookie:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/536.30.1 (KHTML, like Gecko) Version/6.0.5 Safari/536.30.1
Referer: https://idmsa.apple.com/IDMSWebAuth/login.html?appIdKey=77e2a60d4bdfa6b7311c854a56505800be3c24e3a27a670098ff61b69fc5214b&sslEnabled=true&rv=3
Accept-Encoding: gzip, deflate
QuickRadar / response:

HTTP/1.1 302 Moved Temporarily
Date: Thu, 23 Jun 2016 12:15:43 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-API-Version: 1.8
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: JSESSIONID=elPy-v0NpECJPBgkApiTfhci.nwk-radarp-lapp57; Path=/; Secure; HttpOnly
Location: https://idmsa.apple.com/logon
Content-Language: en-US
Content-Length: 0
Keep-Alive: timeout=15, max=5000
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
Notice the difference for Host and Location.

I don't know the background here - why this has been done in the first place. But simply deleting those lines seems to do the trick for me. I can open up a PR for that, unless someone has a better idea.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub #89 (comment), or mute the thread https://github.com/notifications/unsubscribe/AAlA-rstUpox5NrN67mkpxVOU9dCbVm6ks5qOouMgaJpZM4I1Yil.

Fixes the “Too many HTTP redirects” issue during login. See amyworrall#89 (comment) for details.

abbeycode · 2016-06-26T21:59:29Z

Is there any ETA on when a new build will be released?

chockenberry · 2016-06-28T21:12:15Z

I'm building from master using #90 and still seeing these errors.

One thing I have noticed is that the errors occur after I submit my first Radar (e.g. first one works fine, but subsequent ones do not.) Maybe there's something getting cached in the URL connection?

ZevEisenberg · 2016-06-29T14:54:50Z

@chockenberry confirmed: success the first time, "too many HTTP redirects" the second time.

chockenberry · 2016-06-29T16:17:00Z

@amyworrall Sounds like this issue should be reopened. I'm wondering if @steipete and @matej are seeing the same "works the first time, not the second" behavior.

amyworrall · 2016-06-29T16:38:26Z

I'm so sorry that I haven't had any time to look at this yet. I'm a bit swamped at the moment (plus my country is imploding politically, which is distracting). Thanks to everyone who is helping!

Sent from my iPhone

On 29 Jun 2016, at 17:17, Craig Hockenberry notifications@github.com wrote:

@amyworrall Sounds like this issue should be reopened. I'm wondering if @steipete and @matej are seeing the same "works the first time, not the second" behavior.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

steipete · 2016-06-29T19:29:11Z

True. Noticed this as well today. This works once but then it's trouble again... probably won't be as easy to fix than just deleting a line. But it went from not working at all to at least somewhat working :)

matej · 2016-07-01T07:13:17Z

Looks like that's their way to rate limit you guys. ;)

The requests do differ between the first and second attempt.

One thing I noticed is that the authenticate action on the login page no longer has the session ID the second time around.

This leads to a different authenticate URL being invoked and things go south from there on.

First:

Second:

There is probably no need to even login at this point (the session could be reused). But since that would require even more and special casing, I just decided to purge cookies before we start. That should make every request equal to the first one. Seems to work.

Just deleting the "myacinfo" cookie appears to be enough, so this could be limited a bit, if anyone has any good arguments on why we should keep the remaining ones.

matej added a commit to PSPDFKit-labs/QuickRadar that referenced this issue Jun 23, 2016

Avoid setting the Host key explicitly

d7307f9

Fixes the “Too many HTTP redirects” issue during login. See amyworrall#89 (comment) for details.

matej mentioned this issue Jun 23, 2016

Avoid setting the Host key explicitly #90

Merged

amyworrall closed this as completed in #90 Jun 23, 2016

guillaumealgis mentioned this issue Jun 23, 2016

Unable to post: too many HTTP redirects #91

Closed

matej mentioned this issue Jul 1, 2016

Fixes HTTP redirect issues when posting a second time #92

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Getting "Too many HTTP redirects" when attempting to file radars #89

Getting "Too many HTTP redirects" when attempting to file radars #89

ZevEisenberg commented Jun 14, 2016

orta commented Jun 16, 2016

keith commented Jun 16, 2016 •

edited

Loading

abbeycode commented Jun 19, 2016

orta commented Jun 19, 2016

orta commented Jun 20, 2016

steipete commented Jun 20, 2016 •

edited

Loading

matej commented Jun 23, 2016

amyworrall commented Jun 23, 2016

abbeycode commented Jun 26, 2016

chockenberry commented Jun 28, 2016

ZevEisenberg commented Jun 29, 2016

chockenberry commented Jun 29, 2016

amyworrall commented Jun 29, 2016

steipete commented Jun 29, 2016

matej commented Jul 1, 2016

Getting "Too many HTTP redirects" when attempting to file radars #89

Getting "Too many HTTP redirects" when attempting to file radars #89

Comments

ZevEisenberg commented Jun 14, 2016

orta commented Jun 16, 2016

keith commented Jun 16, 2016 • edited Loading

abbeycode commented Jun 19, 2016

orta commented Jun 19, 2016

orta commented Jun 20, 2016

steipete commented Jun 20, 2016 • edited Loading

matej commented Jun 23, 2016

amyworrall commented Jun 23, 2016

abbeycode commented Jun 26, 2016

chockenberry commented Jun 28, 2016

ZevEisenberg commented Jun 29, 2016

chockenberry commented Jun 29, 2016

amyworrall commented Jun 29, 2016

steipete commented Jun 29, 2016

matej commented Jul 1, 2016

keith commented Jun 16, 2016 •

edited

Loading

steipete commented Jun 20, 2016 •

edited

Loading