I have an odd problem. My new Drupal 8 site is a distro, purchased from ThemeForest. After installing it, I thought I created a new user correctly but maybe the name had disallowed characters. In any case, after logging out for the first time, I can't get back in, even when using the browser-stored un/pw or my stored record. I then created a new user in Drush, elevated it to admin, and still can't get in, saying it doesn't recognize the user. I tried applying for new password, but when I try the link, I get this:

Redirects to external URLs are not allowed by default, use \Drupal\Core\Routing\TrustedRedirectResponse for it.

So then I thought, maybe I should have set my trusted domains to fix the error in the Status Report. I then edited my settings php to set my domain as trusted, similar to what I did for another Drupal 8 site that is side-by-side in the same public_html folder.

However, one difference is that the site I'm now locked out of is being redirected by htaccess. I had to do this because my hosting service by default wants to put my primary-domain site in the root of public_html, and I wanted it in a subfolder, just like the other sites. So I created this htaccess rule to point the main domain to a particular folder:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^mydomain.com$ [NC,OR]
RewriteCond %{HTTP_HOST} ^www.mydomain.com$
RewriteCond %{REQUEST_URI} !folderitresidesin/
RewriteRule (.*) /folderwhereitresides/$1 [L]

Those are the most relevant facts I can think of. Now the question is: does this htaccess redirect affect login? Do I need to do anything to make sure Drupal understands this htaccess redirect? Or is it something else?

I've looked into the "Drupal\Core\Routing\TrustedRedirectResponse" message but that seems to b aimed at redirecting to external urls. I don't see how that applies to me.

Thanks in advance to any good samaritan who can help!

  • You commented out the RewriteBase in your Drupal's .htaccess, right? RewriteBase /folderwhereitresides
    – leymannx
    Feb 9, 2018 at 19:37

1 Answer 1


For a while it seemed that adding localhost to the Trusted Host settings in settings php did some good, then I realized it didn't so I removed it, leaving just the lines below:

$settings['container_yamls'][] = $app_root . '/' . $site_path . '/services.yml';
$settings['trusted_host_patterns'] = array(

I think the Trusted Host settings is critical for several reasons. But then out of the blue I somehow found I can enter the site by logging into


Even though it throws the error page with this message:

Redirects to external URLs are not allowed by default, use \Drupal\Core\Routing\TrustedRedirectResponse for it.

However I'm actually logged in. All I have to do is append the site folder name to the path then I'm in.


In fact, I can just log in by going to


The sitefolder added to the URL seems to be an alternate url for the entire site. I don't know if that will cause a problem but at least most of my problems are solved for now.

I hope this helps somebody. It seems to result from shared hosting not letting me install my primary site to a subfolder in public_html without making a fancy adjustment in htaccess.

  • You should simply put in the root, imho.
    – leymannx
    Feb 9, 2018 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.