ERR_TOO_MANY_REDIRECTS is almost always Flexible SSL

"""Detect the Cloudflare settings combination that causes a redirect loop.

Flexible SSL plus an origin that forces HTTPS is the classic cause: Cloudflare
requests over HTTP, the origin redirects to HTTPS, Cloudflare follows it back. Both
ends are behaving correctly, which is why it is hard to see from either one.
"""
import argparse
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("cloudflare_ssl_mode_check")

API = "https://api.cloudflare.com/client/v4"


def diagnose(ssl_mode, always_https, origin_forces_https):
    """Pure decision function over three settings.

    The loop needs a plaintext hop AND something redirecting it back. Either alone
    is fine, which is why this checks the combination rather than the SSL mode on
    its own.
    """
    problems = []
    if ssl_mode == "off":
        problems.append("SSL is off entirely; visitors are unencrypted")
    if ssl_mode == "flexible":
        if origin_forces_https:
            problems.append("Flexible SSL with an origin that forces HTTPS -- this is "
                            "the redirect loop. Set Full (strict).")
        else:
            problems.append("Flexible SSL: the Cloudflare-to-origin hop is plaintext "
                            "even though visitors see a padlock")
    if ssl_mode == "full":
        problems.append("Full (not strict) does not validate the origin certificate; "
                        "use Full (strict) unless the origin is self-signed")
    if always_https and origin_forces_https and ssl_mode in ("flexible", "off"):
        problems.append("Always Use HTTPS and an origin redirect are stacked on a "
                        "plaintext origin hop")
    return problems


def get(session, url):
    r = session.get(url, timeout=30)
    r.raise_for_status()
    return r.json().get("result", {})


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--zone-id", required=True)
    ap.add_argument("--origin-forces-https", action="store_true",
                    help="set if the origin redirects http to https")
    ap.add_argument("--set-mode", choices=["full", "strict"],
                    help="'strict' maps to Cloudflare's full(strict)")
    ap.add_argument("--apply", action="store_true")
    args = ap.parse_args()

    token = os.environ.get("CF_API_TOKEN")
    if not token:
        log.error("set CF_API_TOKEN")
        return 2
    s = requests.Session()
    s.headers.update({"Authorization": f"Bearer {token}"})

    ssl_mode = get(s, f"{API}/zones/{args.zone_id}/settings/ssl").get("value")
    always = get(s, f"{API}/zones/{args.zone_id}/settings/always_use_https").get("value") == "on"
    log.info("ssl mode=%s  always_use_https=%s  origin_forces_https=%s",
             ssl_mode, always, args.origin_forces_https)

    problems = diagnose(ssl_mode, always, args.origin_forces_https)
    for p in problems:
        log.error(p)

    if args.set_mode:
        value = "strict" if args.set_mode == "strict" else "full"
        if args.apply:
            s.patch(f"{API}/zones/{args.zone_id}/settings/ssl",
                    json={"value": value}, timeout=30).raise_for_status()
            log.info("ssl mode set to %s -- purge the cache, a 301 outlives the fix", value)
        else:
            log.info("WOULD set ssl mode to %s -- pass --apply", value)
    return 1 if problems else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Detect the Cloudflare settings combination that causes a redirect loop.
 *
 * Flexible SSL plus an origin that forces HTTPS is the classic cause. Both ends are
 * behaving correctly, which is why it is hard to see from either one.
 */
const API = 'https://api.cloudflare.com/client/v4';

/**
 * Pure decision function over three settings.
 *
 * The loop needs a plaintext hop AND something redirecting it back. Either alone is
 * fine, which is why this checks the combination.
 */
export function diagnose(sslMode, alwaysHttps, originForcesHttps) {
  const problems = [];
  if (sslMode === 'off') problems.push('SSL is off entirely; visitors are unencrypted');
  if (sslMode === 'flexible') {
    problems.push(originForcesHttps
      ? 'Flexible SSL with an origin that forces HTTPS -- this is the redirect loop. Set Full (strict).'
      : 'Flexible SSL: the Cloudflare-to-origin hop is plaintext even though visitors see a padlock');
  }
  if (sslMode === 'full') {
    problems.push('Full (not strict) does not validate the origin certificate; '
      + 'use Full (strict) unless the origin is self-signed');
  }
  if (alwaysHttps && originForcesHttps && ['flexible', 'off'].includes(sslMode)) {
    problems.push('Always Use HTTPS and an origin redirect are stacked on a plaintext origin hop');
  }
  return problems;
}

async function main() {
  const zone = process.argv[process.argv.indexOf('--zone-id') + 1];
  const originForces = process.argv.includes('--origin-forces-https');
  const apply = process.argv.includes('--apply');
  const setMode = process.argv[process.argv.indexOf('--set-mode') + 1];
  const token = process.env.CF_API_TOKEN;
  if (!token) { console.error('set CF_API_TOKEN'); process.exit(2); }
  const headers = { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' };

  const get = async (path) => (await (await fetch(`${API}${path}`, { headers })).json()).result ?? {};
  const sslMode = (await get(`/zones/${zone}/settings/ssl`)).value;
  const always = (await get(`/zones/${zone}/settings/always_use_https`)).value === 'on';
  console.log(`ssl mode=${sslMode}  always_use_https=${always}  origin_forces_https=${originForces}`);

  const problems = diagnose(sslMode, always, originForces);
  problems.forEach((p) => console.error(p));

  if (process.argv.includes('--set-mode')) {
    const value = setMode === 'strict' ? 'strict' : 'full';
    if (apply) {
      await fetch(`${API}/zones/${zone}/settings/ssl`,
        { method: 'PATCH', headers, body: JSON.stringify({ value }) });
      console.log(`ssl mode set to ${value} -- purge the cache, a 301 outlives the fix`);
    } else {
      console.log(`WOULD set ssl mode to ${value} -- pass --apply`);
    }
  }
  process.exit(problems.length ? 1 : 0);
}

if (import.meta.url === `file://${process.argv[1]}`) main();

from cloudflare_ssl_mode_check import diagnose


def test_strict_with_a_redirecting_origin_is_fine():
    assert diagnose("strict", True, True) == []


def test_flexible_plus_origin_redirect_is_the_loop():
    problems = diagnose("flexible", False, True)
    assert any("redirect loop" in p for p in problems)


def test_flexible_alone_is_still_flagged_as_insecure():
    """It works, but the second hop is plaintext behind a padlock."""
    problems = diagnose("flexible", False, False)
    assert problems and not any("redirect loop" in p for p in problems)


def test_full_without_strict_is_flagged():
    assert any("does not validate" in p for p in diagnose("full", False, False))


def test_ssl_off_is_reported():
    assert any("SSL is off" in p for p in diagnose("off", False, False))

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { diagnose } from './cloudflare-ssl-mode-check.mjs';

test('strict with a redirecting origin is fine', () => {
  assert.deepEqual(diagnose('strict', true, true), []);
});

test('flexible plus an origin redirect is the loop', () => {
  assert.ok(diagnose('flexible', false, true).some((p) => p.includes('redirect loop')));
});

test('flexible alone is still flagged as insecure', () => {
  const p = diagnose('flexible', false, false);
  assert.ok(p.length && !p.some((x) => x.includes('redirect loop')));
});

test('full without strict is flagged', () => {
  assert.ok(diagnose('full', false, false).some((p) => p.includes('does not validate')));
});