有循环重定向的可能

```
if (!this.session) {
debug('this.session not exists');
// ignore not match path
if (!loginRequired) {
debug('not match needLogin path, %j', this.path);
return yield next;
}
debug('relogin again');
return yield loginHandler.call(this, next);
}

// get login path
if (this.path === options.loginPath) {
debug('match login path');
return yield loginHandler.call(this, next);
}
```

场景：
当
loginPath=/login
loginHost=demo.xxx.com
浏览器中输入demo.xxx.com/login （带有部分cookie），这是就能跳过第一个判断if (!this.session)
而 if (this.path === options.loginPath) 符合条件！
最终就会执行到loginHandler 的 redirect(this, loginURL);
@fengmk2

Start by tracing the middleware branch shown in the issue, focusing on this.session, options.loginPath, loginHandler, and redirect. Reproduce the /login request with partial cookies and verify that the login path no longer redirects back to itself while normal unauthenticated redirects still work.

Written by the indexing model from the issue text.