# Perspective login redirect loop

**URL:** <https://forum.inductiveautomation.com/t/perspective-login-redirect-loop/40740>\
**Category:** Ignition\
**Created:** [November 17, 2020, 5:05pm UTC](https://forum.inductiveautomation.com/t/perspective-login-redirect-loop/40740 "2020-11-17T17:05:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![adam.todorski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adam.todorski/32/19388_2.png) [@adam.todorski](https://forum.inductiveautomation.com/u/adam.todorski)\
**Post date:** [November 17, 2020, 5:05pm UTC](https://forum.inductiveautomation.com/t/perspective-login-redirect-loop/40740/1 "2020-11-17T17:05:18Z")

</div>

This is with 8.0.16. I have a perspective UI behind a reverse proxy and I can access the gateway web page, log in, and interact with it but when I try to load a perspective session it gets through the login form then goes into a loop loading the different components and finally drops me back at the login page. The same credentials work with the same project when connecting directly to the gateway.

The gateway web server config is set up with the hostname and port that the external proxy are accessed with for the public address and port. The reverse proxy (nginx) config is as follows:

server {  
listen 443 ssl;  
server\_name scada-hmi-external.domain.redacted;  
set $backend “[https://scada-hmi-internal.domain.redacted:8043](https://scada-hmi-internal.domain.redacted:8043)”;  
location / {  
proxy\_pass $backend;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Host scada-hmi-external.domain.redacted;  
client\_max\_body\_size 10m;  
proxy\_read\_timeout 900;  
}  
…  
(ssl and other auth setup omitted)

Any ideas what might be wrong? I am stumped. Watching it try to load in the browser inspector seems to point to something wrong with the built in identity provider but I don’t see an obvious cause.

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [November 17, 2020, 5:49pm UTC](https://forum.inductiveautomation.com/t/perspective-login-redirect-loop/40740/2 "2020-11-17T17:49:27Z")

</div>

Are there any seemingly related errors in the gateway or browser logs? If not, try setting these gateway loggers to debug level and reproduce the issue again (and let me know if there are any new errors logged):

```auto
gateway.IdpAdapter
gateway.UserAttributeMapper
gateway.ExpressionSecurityLevelPolicy
gateway.WebAuthSessionImpl

```

Could you also tell me more about your setup:

1. Is your reverse proxy performing TLS termination?
2. Is your reverse proxy connecting to the backend gateway over TLS?
3. What kind of IdP is involved? Internal Ignition IdP, OIDC, or SAML?
4. Which web browser and version are you using? Which OS and version is your web browser running on?

---

<div class="post-metadata">

**Author:** ![adam.todorski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/adam.todorski/32/19388_2.png) [@adam.todorski](https://forum.inductiveautomation.com/u/adam.todorski)\
**Post date:** [December 3, 2020, 2:49pm UTC](https://forum.inductiveautomation.com/t/perspective-login-redirect-loop/40740/3 "2020-12-03T14:49:12Z")

</div>

@jspecht we found the problem: the reverse proxy was not upgrading the web socket connection to HTTP, we needed to add the following to our nginx config for it to work:

```
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
```