# Redirect loop for initial password change, behind nginx SSL reverse-proxy

**URL:** <https://forum.gitea.com/t/redirect-loop-for-initial-password-change-behind-nginx-ssl-reverse-proxy/684>\
**Category:** Install/Maintain/Configure\
**Created:** [November 8, 2018, 11:48am UTC](https://forum.gitea.com/t/redirect-loop-for-initial-password-change-behind-nginx-ssl-reverse-proxy/684 "2018-11-08T11:48:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![asprionj](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/asprionj/32/374_2.png) [@asprionj](https://forum.gitea.com/u/asprionj)\
**Post date:** [November 8, 2018, 11:48am UTC](https://forum.gitea.com/t/redirect-loop-for-initial-password-change-behind-nginx-ssl-reverse-proxy/684/1 "2018-11-08T11:48:41Z")

</div>

Hi there, I’m successfully running Gitea in the following setup:

- On a server with a static IP only (no domain name)
- In a subdirectory (at /git)
- Behind an nginx reverse-proxy which handles SSL encryption
- Everything in Docker (nginx and Gitea in separate containers) under the same network

The only problem I have is when creating a new user with the option “Require user to change password”. The user can log in, but when trying to do anything, he is redirected to `/git/user/settings/change_password` and just sees an `ERR_TOO_MANY_REDIRECTS`.

Nginx redirects all HTTP requests to HTTPS:

```auto
server {
  listen 80;
  return 301 https://$host$request_uri;
}

```

Then, proxying the incoming HTTPS requests to Gitea:

```auto
server {
  listen 443 ssl;
  # certificate, SSL configuration, ...

  location /git/ {
    proxy_pass http://git_server:3000/ # git_server is the name of the docker-compose service
  }
}

```

I feel like Gitea redirects to the HTTP version of the `change_password` URL, but gets a request coming from the HTTPS version and thus redirects it to HTTP again. But I have no idea how to proof / track this nor how to resolve it. (I’m new to almost every aspect of this setup…)

In Gitea’s `app.ini` I tried both http and https as protocol prefixes for the `ROOT_URL`. I also tried adding a `proxy_redirect http:// https://;` in the nginx config. Neither changed anything. Do I need to somehow rewrite header information to make Gitea believe its redirect worked?

Thanks for any help!

---

<div class="post-metadata">

**Author:** ![gabephan](https://avatars.discourse-cdn.com/v4/letter/g/df705f/32.png) [@gabephan](https://forum.gitea.com/u/gabephan)\
**Post date:** [January 24, 2019, 7:59pm UTC](https://forum.gitea.com/t/redirect-loop-for-initial-password-change-behind-nginx-ssl-reverse-proxy/684/2 "2019-01-24T19:59:35Z")

</div>

@asprionj Did you ever fix this issue? I’m having the same problem.

---

<div class="post-metadata">

**Author:** ![asprionj](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/asprionj/32/374_2.png) [@asprionj](https://forum.gitea.com/u/asprionj)\
**Post date:** [January 24, 2019, 9:35pm UTC](https://forum.gitea.com/t/redirect-loop-for-initial-password-change-behind-nginx-ssl-reverse-proxy/684/3 "2019-01-24T21:35:43Z")

</div>

Nope, haven’t solved it. The quick & dirty fix is to just deactivate the option `Require user to change password` when creating new user accounts.

The problem (with this problem 😉 ) is that it probably emerges from the combination of the NGINX reverse-proxy with Gitea and does not occur otherwise. This fact makes it hard to pinpoint the problem.

---

<div class="post-metadata">

**Author:** ![xdch47](https://avatars.discourse-cdn.com/v4/letter/x/e79b87/32.png) [@xdch47](https://forum.gitea.com/u/xdch47)\
**Post date:** [February 5, 2019, 8:11am UTC](https://forum.gitea.com/t/redirect-loop-for-initial-password-change-behind-nginx-ssl-reverse-proxy/684/4 "2019-02-05T08:11:23Z")

</div>

This patch from this PR solves the issue for me

> <https://github.com/go-gitea/gitea/pull/5965>