{"record":{"id":"0f02596f4ad8c1ca","repo":"hashicorp/terraform","slug":"too-many-redirects","errorCode":null,"errorMessage":"too many redirects","messagePattern":"too many redirects","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/http_mirror_source.go","lineNumber":55,"sourceCode":"\nvar _ Source = (*HTTPMirrorSource)(nil)\n\n// NewHTTPMirrorSource constructs and returns a new network mirror source with\n// the given base URL. The relative URL offsets defined by the HTTP mirror\n// protocol will be resolve relative to the given URL.\n//\n// The given URL must use the \"https\" scheme, or this function will panic.\n// (When the URL comes from user input, such as in the CLI config, it's the\n// UI/config layer's responsibility to validate this and return a suitable\n// error message for the end-user audience.)\nfunc NewHTTPMirrorSource(baseURL *url.URL, creds svcauth.CredentialsSource) *HTTPMirrorSource {\n\thttpClient := httpclient.New()\n\thttpClient.Timeout = requestTimeout\n\thttpClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {\n\t\t// If we get redirected more than five times we'll assume we're\n\t\t// in a redirect loop and bail out, rather than hanging forever.\n\t\tif len(via) > 5 {\n\t\t\treturn fmt.Errorf(\"too many redirects\")\n\t\t}\n\t\treturn nil\n\t}\n\t// Enforce TLS\n\treturn newHTTPMirrorSourceWithHTTPClientTLS(baseURL, creds, httpClient)\n}\n\nfunc NewMockHTTPMirrorSource(t *testing.T, baseURL *url.URL) *HTTPMirrorSource {\n\thttpClient := httpclient.New()\n\thttpClient.Timeout = requestTimeout\n\thttpClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {\n\t\t// If we get redirected more than five times we'll assume we're\n\t\t// in a redirect loop and bail out, rather than hanging forever.\n\t\tif len(via) > 5 {\n\t\t\treturn fmt.Errorf(\"too many redirects\")\n\t\t}\n\t\treturn nil\n\t}","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/http_mirror_source.go#L37-L73","documentation":"The mirror HTTP client installs a CheckRedirect hook that aborts once more than 5 redirects have been followed (len(via) > 5), to avoid hanging on redirect loops. When the cap is exceeded the request fails with this error, which the caller wraps in ErrQueryFailed. It indicates either a genuine loop or an over-long redirect chain on the mirror.","triggerScenarios":"A GET to the mirror's index.json or <version>.json endpoint receives a chain of more than five 301/302/303/307/308 responses. Typical causes: a reverse proxy or CDN that rewrites the path on each hop, an http<->https bounce, or a missing-trailing-slash rule that redirects to itself.","commonSituations":"Mirror fronted by a misconfigured load balancer/ingress; TLS redirect loop because the mirror forces HTTPS but the client request is already HTTPS yet rewritten; base URL missing a required path prefix so the server keeps redirecting.","solutions":["Reproduce the chain with curl -ILv <mirror-url>/<host>/<ns>/<type>/index.json and fix the server so the final URL is reached within 5 hops.","Correct the configured base URL (scheme, host, path prefix, trailing slash) so no redirect is needed.","Eliminate http->https->http bounces by serving HTTPS end-to-end on the mirror."],"exampleFix":"# before\nprovider_installation {\n  network_mirror { url = \"http://mirror.local/tf/\" }   # bounces http<->https\n}\n\n# after\nprovider_installation {\n  network_mirror { url = \"https://mirror.local/tf/\" }\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"var qf getproviders.ErrQueryFailed\nif errors.As(err, &qf) && strings.Contains(qf.Error(), \"too many redirects\") {\n    // log final URL from qf.MirrorURL, alert the mirror operator\n}","preventionTips":["Preflight the mirror URL with curl -ILv to confirm <6 redirects.","Serve the mirror over HTTPS end-to-end to avoid scheme bounces.","Watch for trailing-slash redirect rules that target themselves."],"tags":["network","http","redirect","mirror"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}