Understanding redirects - Redirects work in Trace but not in browser

mikegmcd · February 6, 2025, 3:44pm

What is the name of the domain?

content.azresource.net

What is the issue you’re encountering

I’m new to Cloudflare and am setting up a POC around redirects/bulk redirects. I’m seeing redirect loops.

What steps have you taken to resolve the issue?

DNS imported from another provider
Created proxied (A) records where applicable

What are the steps to reproduce the issue?

Moved to Cloudflare DNS
Created Proxied DNS entry
Visited page in browser (seems to work correctly)
Created a redirect from /resources/ to /government/
This redirect does not work properly
/government/ returns a 301 in Cloudflare trace, but not in browser (see image)

I think this may be resolving a circular redirect, but I’m not sure why.

Screenshot of the error

mikegmcd · February 6, 2025, 5:56pm

I think I found the issue with the 301 Moved Permanently (thank you cf.shr.dev). I had to set SSL/TLS to Full Strict.

I no longer see the looping redirect, but I do see a 403 to the redirect target from the above link. The browser still does not redirect. DNS propagation appears complete.

mikegmcd · February 6, 2025, 6:18pm

https://cf.sjr.dev/tools/check?fb90230322a1459c9eb678c2a6eeb4b9

GeorgeAppiah · February 6, 2025, 7:29pm

I can see the proxied subdomain content.novascotia.ca now 301-redirects to the unproxied subdomain beta.novascotia.ca.

Have you figured this out now and moved on?

mikegmcd · February 6, 2025, 7:44pm

I have not moved on, but I think I understand the initial problem. The issue now is that although redirects seem to work when tested with ‘Trace’ or ‘cf.sjr.dev’, redirects are not happening in the browser.

For example, if I visit https://content.azresource.net/resources/ I would expect to be redirected to https://content.azresource.net/government/

cscharff · February 6, 2025, 9:36pm

You are…

curl -Ikv https://content.azresource.net/resources/
* Host content.azresource.net:443 was resolved.
* IPv6: 2606:4700:3030::ac43:80af, 2606:4700:3033::6815:227
* IPv4: 172.67.128.175, 104.21.2.39
*   Trying [2606:4700:3030::ac43:80af]:443...
* Connected to content.azresource.net (2606:4700:3030::ac43:80af) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=azresource.net
*  start date: Feb  6 12:00:04 2025 GMT
*  expire date: May  7 12:58:21 2025 GMT
*  issuer: C=US; O=Google Trust Services; CN=WE1
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://content.azresource.net/resources/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: content.azresource.net]
* [HTTP/2] [1] [:path: /resources/]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> HEAD /resources/ HTTP/2
> Host: content.azresource.net
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/2 301 
HTTP/2 301 
< date: Thu, 06 Feb 2025 21:34:59 GMT
date: Thu, 06 Feb 2025 21:34:59 GMT
< content-type: text/html
content-type: text/html
< content-length: 167
content-length: 167
< cache-control: max-age=3600
cache-control: max-age=3600
< expires: Thu, 06 Feb 2025 22:34:59 GMT
expires: Thu, 06 Feb 2025 22:34:59 GMT
< location: /government/
location: /government/
< report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=teqcvQjuz%2B1gSjSRwiGF%2FH5MXg4dDsKCwD%2Fiy2BqaPsb8pG%2F32qRvp%2B%2FPc53U2KdPY3Dfv%2FfxZL4Da4nnbFMPhPTT9BKqYQFD%2B3ysmOv8vTihlaGFeFfLGRJk5ireJUBI6h4VXHx34nTFleKJcXUssEptpTQ"}],"group":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=teqcvQjuz%2B1gSjSRwiGF%2FH5MXg4dDsKCwD%2Fiy2BqaPsb8pG%2F32qRvp%2B%2FPc53U2KdPY3Dfv%2FfxZL4Da4nnbFMPhPTT9BKqYQFD%2B3ysmOv8vTihlaGFeFfLGRJk5ireJUBI6h4VXHx34nTFleKJcXUssEptpTQ"}],"group":"cf-nel","max_age":604800}
< nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
< server: cloudflare
server: cloudflare
< cf-ray: 90de4474cf3567aa-DFW
cf-ray: 90de4474cf3567aa-DFW
<

The origin server has an SSL issue once redirected, but the redirect is working.

curl -ikv https://content.azresource.net/government/
* Host content.azresource.net:443 was resolved.
* IPv6: 2606:4700:3030::ac43:80af, 2606:4700:3033::6815:227
* IPv4: 172.67.128.175, 104.21.2.39
*   Trying [2606:4700:3030::ac43:80af]:443...
* Connected to content.azresource.net (2606:4700:3030::ac43:80af) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=azresource.net
*  start date: Feb  6 12:00:04 2025 GMT
*  expire date: May  7 12:58:21 2025 GMT
*  issuer: C=US; O=Google Trust Services; CN=WE1
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://content.azresource.net/government/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: content.azresource.net]
* [HTTP/2] [1] [:path: /government/]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET /government/ HTTP/2
> Host: content.azresource.net
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/2 525 
HTTP/2 525 
< date: Thu, 06 Feb 2025 21:37:17 GMT
date: Thu, 06 Feb 2025 21:37:17 GMT
< content-type: text/plain; charset=UTF-8
content-type: text/plain; charset=UTF-8
< content-length: 15
content-length: 15
< report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWvRFjG0v5TklQcpn71TelHpUEBkZMlmH%2B6cy7Q87Tdm9QsBeeCMua%2FJjAV1tQ7mSZAIjGPI6tH035VlNl2bFXm5w8trVpL9Z9sg9FNyX7xya%2FohlJ9VmDVJ%2BuwR5j2BgO9y3GpevsbdyY5tIWdJo0Tzeo%2Fj"}],"group":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWvRFjG0v5TklQcpn71TelHpUEBkZMlmH%2B6cy7Q87Tdm9QsBeeCMua%2FJjAV1tQ7mSZAIjGPI6tH035VlNl2bFXm5w8trVpL9Z9sg9FNyX7xya%2FohlJ9VmDVJ%2BuwR5j2BgO9y3GpevsbdyY5tIWdJo0Tzeo%2Fj"}],"group":"cf-nel","max_age":604800}
< nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
< x-frame-options: SAMEORIGIN
x-frame-options: SAMEORIGIN
< referrer-policy: same-origin
referrer-policy: same-origin
< cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< expires: Thu, 01 Jan 1970 00:00:01 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
< server: cloudflare
server: cloudflare
< cf-ray: 90de47d25aab2cbd-DFW
cf-ray: 90de47d25aab2cbd-DFW
< alt-svc: h3=":443"; ma=86400
alt-svc: h3=":443"; ma=86400
< server-timing: cfL4;desc="?proto=TCP&rtt=14654&min_rtt=13900&rtt_var=4381&sent=9&recv=11&lost=0&retrans=0&sent_bytes=2920&recv_bytes=589&delivery_rate=268972&cwnd=233&unsent_bytes=0&cid=4256f421ab230f50&ts=183&x=0"
server-timing: cfL4;desc="?proto=TCP&rtt=14654&min_rtt=13900&rtt_var=4381&sent=9&recv=11&lost=0&retrans=0&sent_bytes=2920&recv_bytes=589&delivery_rate=268972&cwnd=233&unsent_bytes=0&cid=4256f421ab230f50&ts=183&x=0"
<

mikegmcd · February 7, 2025, 2:06pm

Thanks, it may have been DNS propagation. The redirect is now happening, but you are right, I am getting the 525 error. I’m working through the document now, but no luck so far.

system · February 9, 2025, 2:06pm

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Redirect not redirecting DNS & Network	3	406	January 14, 2024
Https -> http loop for custom domain in Cloudflare Page Cloudflare Pages	21	18	March 7, 2025
Bulk Redirects Not Working - New to CF Getting Started	14	2326	September 2, 2022
Https redirect loop DNS & Network	1	1556	May 13, 2022
PageRule 301 redirect for subdomain not working DNS & Network	7	4525	October 11, 2020