bramus / bramus/mixed-content-scan

Odd 303 redirect loop

Open
#65 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
516
Forks
50
PR merge metrics
No merged PRs in 30d

Description

I've run into an odd issue where only a single page on a site I'm scanning is producing a `303` redirect loop and ultimately erroring out with `MCS.CRITICAL: cURL Error (47): Maximum (20) redirects followed`.

The odd part being I'm unable to reproduce this `303` code response outside of `mixed-content-scan`. I've tested in multiple browsers, stock `CLI cURL`, and a few other random online scanner/validator tools but I'm not seeing any issues with the page. While `mixed-content-scan` produces this error on both my windows box and linux server.

Normally I would consider this purely a site configuration issue and unrelated to `mixed-content-scan` but since I can't reproduce it anywhere else I'm a bit stumped. From what I know about the server config and software there is no reason a redirect should be happening there and if there was it would be using `301`/`302` codes. While researching this issue I also found reports that this can happen when trying to access a page with `POST` when `GET` is required but I can clearly see in the debug output that `cURL` is using `GET`.
___

> ## Steps to reproduce on my windows box
> ```
> composer require bramus/mixed-content-scan:~2.8
> cd .\vendor\bramus\mixed-content-scan\bin\
> php .\mixed-content-scan https://www.458parts.com/index.php/cart --no-check-certificate
> ```

> ## Steps to reproduce on my linux server
> ```
> composer global require bramus/mixed-content-scan:~2.8
> mixed-content-scan https://www.458parts.com/index.php/cart
> ```

Here is a gist of the cmd output with verbose `cURL` debugging turned on:
> https://gist.github.com/Spunkie/0a1756729446b316a602823cd8589338

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the bin/mixed-content-scan entry point and reproduce the command against the reported URL using PHP and verbose cURL debugging. Compare the scan's redirect handling with the supplied gist and determine why it follows a 303 loop; done means the scan no longer fails incorrectly on this case and the behavior is verified on the reported Windows and Linux commands.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
cli, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.