You're browsing the documentation for an old version of SupportPal. Consider upgrading to the [latest version](https://docs.supportpal.com/current/Troubleshoot+Redirect+Loops). 

# Troubleshoot Redirect Loops

## Problem

SupportPal is stuck in a redirect loop.

## Possible Cause(s)

- mod\_security is running on your server and falsely detecting the AES encrypted SupportPal session cookie as a threat  
     [Jump to Resolution](#mod_security)
- The `Enable SSL` setting has been enabled in SupportPal but `HTTPS` (port 443) is not configured in your web server.  
     [Jump to Resolution](#enable_ssl)

---

## Disable mod\_security Rules

 The rules used in mod\_security are very generic in nature, this can subsequently lead to false positives. In versions prior to RC1 of CRS 3.0, the redirect is default behaviour when a rule has been violated. From CRS 3.0 RC1 onwards the default behaviour was changed to a 403 Forbidden status specifically because it was causing redirect loops. The mod\_security team are also [aware](https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/451) of cookies causing false positives and are looking for a a fix.

 We recommend that you upgrade to the latest version of CRS 3.0 and if you're still experiencing issues [ implement exceptions ](https://www.trustwave.com/Resources/SpiderLabs-Blog/ModSecurity-Advanced-Topic-of-the-Week--(Updated)-Exception-Handling/). For example, the below exception will bypass a given rule if a cookie named `supportpal` is present:

```
SecRuleUpdateTargetById <rule_number> !REQUEST_COOKIES:supportpal
```

 Please replace `<rule_number>` with the number that is triggering a false positive.

---

## Disable SSL

 See [Manually Disabling SSL Mode](Enable+HTTPS#Manually-Disabling-SSL-Mode) for information on how to regain access to SupportPal.