Answers.Body: <p>This <a href="https://github.com/craftcms/cms/issues/2622" rel="nofollow noreferrer">Github issue</a> helped me solve the problem and it was indeed tied to not forcing everything to SSL. Once I added the code below to my .htaccess to force all HTTP to HTTPs, it solved the problem:</p>
  
  <pre><code>RewriteEngine On
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-27T21:24:39.223Z
Answers.LastActivityDate: 2018-11-27T21:24:39.223Z
Answers.UserDisplayName: dpayne
Body: <p>I followed <a href="https://medium.com/@madebyraygun/a-quick-and-easy-local-environment-for-craft-3-4fd7c7ff5815" rel="nofollow noreferrer">this guide</a> to move my local hosting from WAMP, which has been giving me a bunch of 500 errors since switching to Craft 3, to Local By Flywheel. After getting everything configured, I can access the site and everything seems to be working fine. The issue I'm having is I'm unable to access the control panel to make changes. The login screen keeps just redirecting back to the login screen after entering the credentials. </p>
  
  <p>Here are the details I have as far as what's going on:</p>
  
  <ul>
  <li>I know the credentials I'm entering are correct. I get an error on the login page when I put in an incorrect password</li>
  <li>I've checked the Craft logs and don't see any obvious warnings or error messages related to login</li>
  <li>Removing everything in the Craft log folder doesn't change anything</li>
  <li>I'm running Apache (2.4.1, I believe), PHP 7.0.3, and MySQL 5.5.6</li>
  </ul>
  
  <p>Here is the .htaccess we're using (I don't think it's the issue but I know it's a common one for this sort of stuff):</p>
  
  <pre><code>&lt;IfModule mod_expires.c&gt;
   ExpiresActive on
   # Perhaps better to whitelist expires rules? Perhaps.
   ExpiresDefault "access plus 1 month"
   # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)
   ExpiresByType text/cache-manifest "access plus 0 seconds"
   # Your document html
   ExpiresByType text/html "access plus 0 seconds"
   # Data
   ExpiresByType text/xml "access plus 0 seconds"
   ExpiresByType application/xml "access plus 0 seconds"
   ExpiresByType application/json "access plus 0 seconds"
   # Feed
   ExpiresByType application/rss+xml "access plus 1 hour"
   ExpiresByType application/atom+xml "access plus 1 hour"
   # Favicon (cannot be renamed)
   ExpiresByType image/x-icon "access plus 1 week"
   # Media: images, video, audio
   ExpiresByType image/gif "access plus 1 month"
   ExpiresByType image/png "access plus 1 month"
   ExpiresByType image/jpeg "access plus 1 month"
   ExpiresByType video/ogg "access plus 1 month"
   ExpiresByType audio/ogg "access plus 1 month"
   ExpiresByType video/mp4 "access plus 1 month"
   ExpiresByType video/webm "access plus 1 month"
   # Webfonts
   ExpiresByType application/x-font-ttf "access plus 1 month"
   ExpiresByType font/opentype "access plus 1 month"
   ExpiresByType application/x-font-woff "access plus 1 month"
   ExpiresByType image/svg+xml "access plus 1 month"
   ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
   ExpiresByType text/css "access plus 1 year"
   ExpiresByType application/javascript "access plus 1 year"
  &lt;/IfModule&gt;
  
  &lt;IfModule mod_deflate.c&gt;
   AddOutputFilterByType DEFLATE text/html text/plain text/css application/json
   AddOutputFilterByType DEFLATE application/javascript
   AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
   AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xml
   Addtype font/opentype .otf
   Addtype font/truetype .ttf
   AddOutputFilterByType DEFLATE image/x-icon image/svg+xml application/vnd.msfontobject application/x-font-ttf font/opentype font/truetype
  &lt;/IfModule&gt;
  
  &lt;IfModule mod_rewrite.c&gt;
       RewriteEngine On
  
      # remove version numbers used for cache busting.
      # maps site.min.1234.css to site.min.css
      # See https://nystudio107.com/blog/simple-static-asset-versioning
      RewriteCond %{REQUEST_FILENAME} !-f
      RewriteRule ^(.+)\.(\d+)\.(bmp|css|cur|gif|ico|jpe?g|js|png|svgz?|webp|webmanifest)$ $1.$3 [L]
  
      #301 redirect with trailing slash
          RewriteCond %{REQUEST_URI} /+[^\.]+$
          RewriteRule ^(.+[^/])$ %{REQUEST_URI}/ [R=301,L]
  
      #Send would-be 404 requests to Craft
          RewriteCond %{REQUEST_FILENAME} !-f
          RewriteCond %{REQUEST_FILENAME} !-d
          RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
          RewriteRule (.+) index.php?p=$1 [QSA,L]
    AddType text/x-component .htc
  
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>The only thing that seems a bit odd is on the login page, it keeps redirecting from the HTTPS version to the HTTP version upon form submission. Same login page, but after submission it goes from HTTPs to HTTP and then I can't get past then on subsequent attempts. The rest of the site works fine on HTTPs. Not sure if that could be tied to the issue or what's going on there but wanted to call that out as being of note.</p>
  
Tags: <control-panel><redirect><login><htaccess><https>
Title: Can't Get Past Control Panel Login. Keeps Redirecting Back to Login Page
ThreadText: # Can't Get Past Control Panel Login. Keeps Redirecting Back to Login Page
  
  (Asked by: username_0 on 2018-11-27)
  
  I followed [this guide](https://medium.com/@madebyraygun/a-quick-and-easy-local-environment-for-craft-3-4fd7c7ff5815) to move my local hosting from WAMP, which has been giving me a bunch of 500 errors since switching to Craft 3, to Local By Flywheel. After getting everything configured, I can access the site and everything seems to be working fine. The issue I'm having is I'm unable to access the control panel to make changes. The login screen keeps just redirecting back to the login screen after entering the credentials.
  
  Here are the details I have as far as what's going on:
  
  * I know the credentials I'm entering are correct. I get an error on the login page when I put in an incorrect password
  * I've checked the Craft logs and don't see any obvious warnings or error messages related to login
  * Removing everything in the Craft log folder doesn't change anything
  * I'm running Apache (2.4.1, I believe), PHP 7.0.3, and MySQL 5.5.6
  
  Here is the .htaccess we're using (I don't think it's the issue but I know it's a common one for this sort of stuff):
  
  ```
  <IfModule mod_expires.c>
   ExpiresActive on
   # Perhaps better to whitelist expires rules? Perhaps.
   ExpiresDefault "access plus 1 month"
   # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)
   ExpiresByType text/cache-manifest "access plus 0 seconds"
   # Your document html
   ExpiresByType text/html "access plus 0 seconds"
   # Data
   ExpiresByType text/xml "access plus 0 seconds"
   ExpiresByType application/xml "access plus 0 seconds"
   ExpiresByType application/json "access plus 0 seconds"
   # Feed
   ExpiresByType application/rss+xml "access plus 1 hour"
   ExpiresByType application/atom+xml "access plus 1 hour"
   # Favicon (cannot be renamed)
   ExpiresByType image/x-icon "access plus 1 week"
   # Media: images, video, audio
   ExpiresByType image/gif "access plus 1 month"
   ExpiresByType image/png "access plus 1 month"
   ExpiresByType image/jpeg "access plus 1 month"
   ExpiresByType video/ogg "access plus 1 month"
   ExpiresByType audio/ogg "access plus 1 month"
   ExpiresByType video/mp4 "access plus 1 month"
   ExpiresByType video/webm "access plus 1 month"
   # Webfonts
   ExpiresByType application/x-font-ttf "access plus 1 month"
   ExpiresByType font/opentype "access plus 1 month"
   ExpiresByType application/x-font-woff "access plus 1 month"
   ExpiresByType image/svg+xml "access plus 1 month"
   ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
   ExpiresByType text/css "access plus 1 year"
   ExpiresByType application/javascript "access plus 1 year"
  </IfModule>
  
  <IfModule mod_deflate.c>
   AddOutputFilterByType DEFLATE text/html text/plain text/css application/json
   AddOutputFilterByType DEFLATE application/javascript
   AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
   AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xml
   Addtype font/opentype .otf
   Addtype font/truetype .ttf
   AddOutputFilterByType DEFLATE image/x-icon image/svg+xml application/vnd.msfontobject application/x-font-ttf font/opentype font/truetype
  </IfModule>
  
  <IfModule mod_rewrite.c>
       RewriteEngine On
  
      # remove version numbers used for cache busting.
      # maps site.min.1234.css to site.min.css
      # See https://nystudio107.com/blog/simple-static-asset-versioning
      RewriteCond %{REQUEST_FILENAME} !-f
      RewriteRule ^(.+)\.(\d+)\.(bmp|css|cur|gif|ico|jpe?g|js|png|svgz?|webp|webmanifest)$ $1.$3 [L]
  
      #301 redirect with trailing slash
          RewriteCond %{REQUEST_URI} /+[^\.]+$
          RewriteRule ^(.+[^/])$ %{REQUEST_URI}/ [R=301,L]
  
      #Send would-be 404 requests to Craft
          RewriteCond %{REQUEST_FILENAME} !-f
          RewriteCond %{REQUEST_FILENAME} !-d
          RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
          RewriteRule (.+) index.php?p=$1 [QSA,L]
    AddType text/x-component .htc
  
  </IfModule>
  
  ```
  
  The only thing that seems a bit odd is on the login page, it keeps redirecting from the HTTPS version to the HTTP version upon form submission. Same login page, but after submission it goes from HTTPs to HTTP and then I can't get past then on subsequent attempts. The rest of the site works fine on HTTPs. Not sure if that could be tied to the issue or what's going on there but wanted to call that out as being of note.
  
  **Tags:** control-panel, redirect, login, htaccess, https
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2018-11-27. Score: 1 | Accepted answer
  
  This [Github issue](https://github.com/craftcms/cms/issues/2622) helped me solve the problem and it was indeed tied to not forcing everything to SSL. Once I added the code below to my .htaccess to force all HTTP to HTTPs, it solved the problem:
  
  ```
  RewriteEngine On
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
  
  ```
  
  
  ---
  
  