# Diagnose: redirect loop
## Symptom
Infinite or long redirect chain: app -> Auth0 -> app -> Auth0, ending in ERR_TOO_MANY_REDIRECTS.
## Likely causes
1. Session cookie not sticking: the app sets its session cookie on /callback but the browser rejects it (Secure flag on http, SameSite, or the AUTH0_SECRET rotating per deploy so the cookie never decrypts).
2. Auth guard misconfigured: the app's "requires auth" check runs on the callback route itself, so the freshly authenticated user is bounced back to login.
3. An Action/Rule redirects (`api.redirect.sendUserTo`) without a resume path, or denies then the app retries login.
4. Default login route misconfigured: Auth0's "configure default login routes" sends unauthenticated users to the app login, which sends them back.
## Confirm
- DevTools network tab: count the hops. If /callback returns 302 back to /authorize every time, the app session is not sticking: check the Set-Cookie response and whether the browser stores it.
- If the loop includes an Action redirect URL, the Action is the bouncer: check Actions > Flows and the tenant logs for the redirect event.
- Tenant logs: a successful login (s) followed immediately by another authorize with no token use means the app discarded the session.
## Fix
- Cookie: https in production, stable AUTH0_SECRET/SECRET, correct cookie domain.
- Exclude the callback route from the auth guard.
- Action redirects must call api.redirect with a resume and handle the resume callback; or remove the redirect.
## Verify
One clean login in incognito: authorize -> callback -> app page, three hops, session cookie present, no further redirects on refresh.