title: Server entering redirect loop due to "bad" cookie value
body: <p>I have a situation that an Apache web server running a site on Joomla/php is managing to get itself into a redirect loop.</p>
  
  <p>When visiting <a href="http://www.example.com/" rel="nofollow">http://www.example.com/</a> it is issuing a 302 redirect to <a href="http://www.example.com/" rel="nofollow">http://www.example.com/</a> (yes, the same url).</p>
  
  <p>After some investigation we narrowed it down to the fact that there is a cookie with a value that it doesn't like...</p>
  
  <p>The cookie contents is:</p>
  
  <blockquote>
    <p>%7B%22distinct_id%22%3A%20%22vp37vv%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D</p>
  </blockquote>
  
  <p>To save you the trouble that is urlencoded and decodes to:</p>
  
  <blockquote>
    <p>{"distinct_id": "vp37vv","$initial_referrer":
    "$direct","$initial_referring_domain": "$direct"}</p>
  </blockquote>
  
  <p>My guess was that there was some kind of "security" check going on, that it was looking at the cookie, not liking what it saw there and doing the redirect in misguided attempt to get rid of the bad value.</p>
  
  <p>I noticed that if I put that cookie value in the url then it did a similar redirect. That is going to:</p>
  
  <blockquote>
    <p><a href="http://www.example.com/?c=%7B%22distinct_id%22%3A%20%22vp37vv%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D" rel="nofollow">http://www.example.com/?c=%7B%22distinct_id%22%3A%20%22vp37vv%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D</a></p>
  </blockquote>
  
  <p>resulted in it redirecting to <a href="http://www.example.com/" rel="nofollow">http://www.example.com/</a> (ie it successfully got rid of the value it didn't like). Testing with a "safe" querystring value did not cause the redirect.</p>
  
  <p><strong>So to the question: What could be causing this and what can I do to stop it from happening?</strong></p>
  
  <p>Changing the cookie in any way is not an option since it is part of third party software - I need to make the server accept this cookie's existence.</p>
  
  <p>My guess is that this is a php safety feature but if that is the case then I'm having trouble finding any documentation about it.</p>