Closed Redirection loop on 2FA token expiry

[Xon]

Affected version

2.2.8 Patch 1

There appears to be some sort of edge case when opening a thread which can result in bizarre redirection behaviour on the 2FA token expiring and prompting for a token.

Resulting in this;

https://xenforo.com/community/login/two-step?_xfRedirect=https%3A%2F%2Fxenforo.com%2Fcommunity%2Flogin%2Ftwo-step%3F_xfRedirect%3Dhttps%253A%252F%252Fxenforo.com%252Fcommunity%252Flogin%252Ftwo-step%253F_xfRedirect%253Dhttps%25253A%25252F%25252Fxenforo.com%25252Fcommunity%25252Flogin%25252Ftwo-step%25253F_xfRedirect%25253Dhttps%2525253A%2525252F%2525252Fxenforo.com%2525252Fcommunity%2525252Flogin%2525252Ftwo-step%2525253F_xfRedirect%2525253Dhttps%252525253A%252525252F%252525252Fxenforo.com%252525252Fcommunity%252525252Flogin%252525252Ftwo-step%252525253F_xfRedirect%252525253Dhttps%25252525253A%25252525252F%25252525252Fxenforo.com%25252525252Fcommunity%25252525252Flogin%25252525252Ftwo-step%25252525253F_xfRedirect%25252525253Dhttps%2525252525253A%2525252525252F%2525252525252Fxenforo.com%2525252525252Fcommunity%2525252525252Flogin%2525252525252Ftwo-step%2525252525253F_xfRedirect%2525252525253Dhttps%252525252525253A%252525252525252F%252525252525252Fxenforo.com%252525252525252Fcommunity%252525252525252Flogin%252525252525252Ftwo-step%252525252525253F_xfRedirect%252525252525253Dhttps%25252525252525253A%25252525252525252F%25252525252525252Fxenforo.com%25252525252525252Fcommunity%25252525252525252Flogin%25252525252525252Ftwo-step%25252525252525253F_xfRedirect%25252525252525253Dhttps%2525252525252525253A%2525252525252525252F%2525252525252525252Fxenforo.com%2525252525252525252Fcommunity%2525252525252525252Flogin%2525252525252525252Ftwo-step%2525252525252525253F_xfRedirect%2525252525252525253Dhttps%252525252525252525253A%252525252525252525252F%252525252525252525252Fxenforo.com%252525252525252525252Fcommunity%252525252525252525252Flogin%252525252525252525252Ftwo-step%252525252525252525253F_xfRedirect%252525252525252525253Dhttps%25252525252525252525253A%25252525252525252525252F%25252525252525252525252Fxenforo.com%25252525252525252525252Fcommunity%25252525252525252525252Flogin%25252525252525252525252Ftwo-step%25252525252525252525253F_xfRedirect%25252525252525252525253Dhttps%2525252525252525252525253A%2525252525252525252525252F%2525252525252525252525252Fxenforo.com%2525252525252525252525252Fcommunity%2525252525252525252525252Flogin%2525252525252525252525252Ftwo-step%2525252525252525252525253F_xfRedirect%2525252525252525252525253Dhttps%252525252525252525252525253A%252525252525252525252525252F%252525252525252525252525252Fxenforo.com%252525252525252525252525252Fcommunity%252525252525252525252525252Flogin%252525252525252525252525252Ftwo-step%252525252525252525252525253F_xfRedirect%252525252525252525252525253Dhttps%25252525252525252525252525253A%25252525252525252525252525252F%25252525252525252525252525252Fxenforo.com%25252525252525252525252525252Fcommunity%25252525252525252525252525252Flogin%25252525252525252525252525252Ftwo-step%25252525252525252525252525253F_xfRedirect%25252525252525252525252525253Dhttps%2525252525252525252525252525253A%2525252525252525252525252525252F%2525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252Fcommunity%2525252525252525252525252525252Flogin%2525252525252525252525252525252Ftwo-step%2525252525252525252525252525253F_xfRedirect%2525252525252525252525252525253Dhttps%252525252525252525252525252525253A%252525252525252525252525252525252F%252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252Fcommunity%252525252525252525252525252525252Flogin%252525252525252525252525252525252Ftwo-step%252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525253Dhttps%25252525252525252525252525252525253A%25252525252525252525252525252525252F%25252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252Flogin%25252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525253Dhttps%2525252525252525252525252525252525253A%2525252525252525252525252525252525252F%2525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525253A%252525252525252525252525252525252525252F%252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525253A%25252525252525252525252525252525252525252F%25252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252525252525252Fthreads%2525252525252525252525252525252525252525252525252525252Fcompatibility-for-csrf-protection-cloudflare-full-html-page-caching.202315%2525252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525252525252525253D1%2525252525252525252525252525252525252525252525252526remember%252525252525252525252525252525252525252525252525253D1%25252525252525252525252525252525252525252525252526remember%2525252525252525252525252525252525252525252525253D1%252525252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525252525253D1%2525252525252525252525252525252525252525252526remember%252525252525252525252525252525252525252525253D1%25252525252525252525252525252525252525252526remember%2525252525252525252525252525252525252525253D1%252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525253D1%2525252525252525252525252525252525252526remember%252525252525252525252525252525252525253D1%25252525252525252525252525252525252526remember%2525252525252525252525252525252525253D1%252525252525252525252525252525252526remember%25252525252525252525252525252525253D1%2525252525252525252525252525252526remember%252525252525252525252525252525253D1%25252525252525252525252525252526remember%2525252525252525252525252525253D1%252525252525252525252525252526remember%25252525252525252525252525253D1%2525252525252525252525252526remember%252525252525252525252525253D1%25252525252525252525252526remember%2525252525252525252525253D1%252525252525252525252526remember%25252525252525252525253D1%2525252525252525252526remember%252525252525252525253D1%25252525252525252526remember%2525252525252525253D1%252525252525252526remember%25252525252525253D1%2525252525252526remember%252525252525253D1%25252525252526remember%2525252525253D1%252525252526remember%25252525253D1%2525252526remember%252525253D1%25252526remember%2525253D1%252526remember%25253D1%2526remember%253D1%26remember%3D1&remember=1


The original URL that I tried opening was https://xenforo.com/community/threads/compatibility-for-csrf-protection-cloudflare-full-html-page-caching.202315/

 

[XF Bug Bot]

Automated triage: Not a bug

Thank you for reporting this issue. This report is several years old, and nothing since has confirmed it still happens. The redirect would only keep repeating if the browser's session were lost between requests, and we could not find a cause for that. If it still happens on the current version, please post a new report.

This is an automated assessment. A member of staff may review and update it.

 

[Xon]

This absolutely can happen still happen when cloudflare interrupts the 2fa redirect with an interstitial challenge

 

[Chris D]

If there's more information than we had previously, it's worth posting a new bug report with the additional details, particularly if there are reproduction steps.

There wasn't enough to work with here, unfortunately.