www.jackpotcitycasino1.com: redirect loop with websteps

[bassosimone]

I have been running ./miniooni -n websteps for quite some time and now I noticed it was stuck in a redirect loop with the https://www.jackpotcitycasino1.com/ URL. I am going to investigate either today or soon.

[bassosimone]

So, we clearly need to have tests for the code following redirections that take cookies into account. When we have these tests, than we can consider this redirection episode closer. Here's an initial attempt:

package main

import (
	"net/http"
	"time"
)

func handler(w http.ResponseWriter, req *http.Request) {
	cookie, err := req.Cookie("visited")
	if err != nil || cookie.Value != "1" {
		w.Header().Add("Location", "/")
		http.SetCookie(w, &http.Cookie{
			Name:    "visited",
			Value:   "1",
			Expires: time.Now().Add(60 * time.Minute),
		})
		w.WriteHeader(302)
		return
	}
	w.Write([]byte("Welcome, guest\n"))
}

func main() {
	http.HandleFunc("/", handler)
	http.ListenAndServe(":8080", nil)
}

The existing code works fine with this simple redirection. Now I wonder why. Need to investigate more in depth.

[bassosimone]

So, the insight is that the Accept header we're using is problematic. Here's some evidence:

% curl --resolve 'www.jackpotcitycasino1.com:443:185.31.223.32' -svo/dev/null https://www.jackpotcitycasino1.com/
[snip]
> GET / HTTP/1.1
> Host: www.jackpotcitycasino1.com
> User-Agent: curl/7.64.1
> Accept: */*
> 
< HTTP/1.1 200 OK
[snip]
< 

Compare to:

% curl -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
    -H 'Accept-Language: en-US;q=0.8,en;q=0.5' \
    -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36'  \
    --resolve 'www.jackpotcitycasino1.com:443:185.31.223.32' \
    -svo/dev/null https://www.jackpotcitycasino1.com/
[snip]
> GET / HTTP/1.1
> Host: www.jackpotcitycasino1.com
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: en-US;q=0.8,en;q=0.5
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
> 
< HTTP/1.1 301 Moved Permanently
[snip]
< Location: https://jackpotcitycasino1.com

Now, let's remove Accept-Language:

% curl -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
    -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36'  \
    --resolve 'www.jackpotcitycasino1.com:443:185.31.223.32' \
    -svo/dev/null https://www.jackpotcitycasino1.com/
[snip]
> GET / HTTP/1.1
> Host: www.jackpotcitycasino1.com
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
> 
< HTTP/1.1 200 OK
[snip]

Let's now use the same Accept-Language header used by the Brave browser:

% curl -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
    -H 'Accept-Language: en-US,en;q=0.9' \
    -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36'  \
    --resolve 'www.jackpotcitycasino1.com:443:185.31.223.32' \
    -svo/dev/null https://www.jackpotcitycasino1.com/
[snip]
> GET / HTTP/1.1
> Host: www.jackpotcitycasino1.com
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: en-US,en;q=0.9
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
> 
< HTTP/1.1 200 OK
[snip]

(From my vantage point I cannot say what Web Connectivity would do in this case, because that website is censored in Italy -- and this is why I need to use the --resolve flag above.)