Loop Detected

Active

RFC 5842 §7.2•Since 2010•WebDAV servers, file systems with symlinks, graph traversal APIs, dependency resolution systems

HTTP 508 Loop Detected means the server terminated the operation because it encountered an infinite loop while processing a request with Depth: infinity. Defined in RFC 5842 §7.2 (WebDAV Binding Extensions). The server detected a cycle in the collection graph — recursion aborted.

Description

The 508 Loop Detected status code indicates that the server terminated an operation because it encountered an infinite loop while processing a request with "Depth: infinity". This occurs in WebDAV when traversing a collection tree and the server detects that following bindings or symbolic links would cause it to visit the same resource again — an infinite recursion scenario.

This is fundamentally a SERVER-SIDE detection. Unlike redirect loops (where clients typically give up after ~20 hops), 508 means the server itself discovered the cycle during a recursive operation. The server started walking a directory tree, following bindings and mount points, and ended up back where it started. Rather than spinning forever, it aborts and tells the client why.

The original use case is pure WebDAV: a PROPFIND or COPY with Depth: infinity encounters a bind cycle (resource A contains a binding to a collection that eventually contains A again). The RFC 5842 Binding Extensions specification introduced this code specifically because the existing WebDAV status codes had no way to communicate "I would recurse forever if I kept going."

Outside WebDAV, the semantic has been adopted by APIs that perform graph or tree traversals and need to communicate cycle detection. Any system that walks a directed graph — dependency resolution, organizational hierarchies, linked data traversal — can legitimately use 508 when it detects a circular reference that would cause infinite processing.

The key distinction from other 5xx codes: 508 is not a server malfunction. The server is working correctly — it detected a structural problem in the data it was asked to traverse. The fix is on the data side (remove the circular binding), not the server side.

Examples

WebDAV PROPFIND with Depth: infinity hitting a bind cycle

http

PROPFIND /webdav/shared/ HTTP/1.1
Host: dav.example.com
Depth: infinity
Content-Type: application/xml
Authorization: Bearer token123

<?xml version="1.0" encoding="utf-8"?>
<D:propfind xmlns:D="DAV:">
  <D:allprop/>
</D:propfind>

508 response — loop detected in collection tree

http

HTTP/1.1 508 Loop Detected
Content-Type: application/xml; charset=utf-8

<?xml version="1.0" encoding="utf-8"?>
<D:error xmlns:D="DAV:">
  <D:loop-detected/>
  <D:resource-uri>/webdav/shared/projects/archive/shared</D:resource-uri>
  <D:message>Infinite loop detected: /webdav/shared/projects/archive/shared binds back to /webdav/shared</D:message>
</D:error>

Graph API — circular dependency in resource hierarchy

http

GET /api/v2/organizations/org_42/full-tree?depth=unlimited HTTP/1.1
Host: api.example.com
Accept: application/json
Authorization: Bearer admin-token

508 response — cycle detected in org hierarchy

http

HTTP/1.1 508 Loop Detected
Content-Type: application/json

{"error": "loop_detected", "message": "Circular reference detected in organization hierarchy.", "cycle_path": ["org_42", "org_78", "org_15", "org_42"], "depth_reached": 47, "suggestion": "Use ?depth=N to limit traversal or resolve the circular parent reference."}

Dependency resolution — circular package dependency

http

POST /api/packages/resolve HTTP/1.1
Host: registry.example.com
Content-Type: application/json

{"root": "@app/core", "strategy": "full-tree", "include_transitive": true}

508 response — circular dependency chain

http

HTTP/1.1 508 Loop Detected
Content-Type: application/json

{"error": "circular_dependency", "message": "Dependency cycle detected during resolution.", "cycle": ["@app/core → @lib/utils → @lib/config → @app/core"], "resolution_hint": "Break the cycle by extracting shared types into a leaf package."}

Edge Cases

•508 is NOT the same as a redirect loop (3xx chain). Redirect loops are detected CLIENT-SIDE after ~20 hops. 508 is detected SERVER-SIDE during recursive resource traversal.
•The Depth: infinity header is the trigger — without it, most WebDAV operations won't recurse deep enough to hit a cycle. Limiting depth is the primary mitigation.
•Symbolic links in file systems mounted via WebDAV are the most common cause: /a/b/c → /a creates a cycle that Depth: infinity will discover.
•Some servers return 508 even for non-WebDAV operations when they detect graph cycles — this is a semantic extension beyond the original RFC scope but widely understood.
•A 508 response SHOULD identify where the loop was detected (the resource URI that would be visited twice) so administrators can fix the binding structure.
•Do not confuse 508 with 507 Insufficient Storage — they are adjacent numbers but completely unrelated. 507 = disk full. 508 = recursion detected.
•Rate limiting or retry loops are NOT 508 scenarios. 508 is about data structure cycles, not request-response patterns.

When You'll See This

→WebDAV PROPFIND with Depth: infinity encounters a symbolic link cycle in the mounted file system
→COPY or MOVE operation on a WebDAV collection that contains a binding back to an ancestor collection
→Graph database API traversing a relationship tree and detecting a cycle (org reports to itself through chain)
→Package dependency resolver encountering circular dependencies during full-tree resolution
→Content management system crawling a folder hierarchy with cross-references that form a loop
→Linked data / RDF crawler following owl:sameAs or rdfs:seeAlso links that form a cycle
→Infrastructure-as-code dependency graph with circular module references during plan/apply

Implementation References

Language	Constant
Go	http.StatusLoopDetected
Rust	http::StatusCode::LOOP_DETECTED
Python	http.HTTPStatus.LOOP_DETECTED
Node.js	http.STATUS_CODES[508]
.NET	HttpStatusCode.LoopDetected
Java	508 (no built-in constant — use literal)
PHP	Response::HTTP_LOOP_DETECTED (Symfony)
Ruby	:loop_detected (Rack)

History

Introduced in RFC 5842 (April 2010) as part of the WebDAV Binding Extensions specification. The original WebDAV RFC (RFC 4918) had no mechanism for signaling infinite loops during Depth: infinity operations. As WebDAV deployments grew more complex with cross-collection bindings, mount points, and symbolic links, servers needed a way to abort and communicate why. The IETF registered 508 specifically for this purpose. While rarely seen in mainstream web browsing, it became important in enterprise content management systems (SharePoint, Alfresco, ownCloud) and has been adopted semantically by modern APIs for any circular reference detection in graph traversal operations.

Related Status Codes

507 Insufficient Storage 424 Failed Dependency 207 Multi-Status 500 Internal Server Error

Related Headers

Depth Destination

FAQ

What is the difference between HTTP 508 Loop Detected and a redirect loop?

A redirect loop is a CLIENT-SIDE detection: the browser follows 301/302/307 responses and gives up after ~20 hops (ERR_TOO_MANY_REDIRECTS). HTTP 508 is SERVER-SIDE: the server itself discovers a cycle while recursively traversing resources (typically WebDAV collections with Depth: infinity). The redirect loop never reaches the server as a single recursive operation — each hop is a separate request. With 508, the server is doing one deep recursive operation internally and discovers it would loop forever.

When should my API return 508 instead of 500 for circular references?

Use 508 when the cycle is a structural property of the DATA being traversed, not a server bug. If your API walks a graph (org hierarchy, dependency tree, linked resources) and detects a cycle that prevents completion, 508 communicates exactly what happened. Use 500 only for unexpected server failures. The benefit of 508: the client knows the fix is to either limit traversal depth, or resolve the circular reference in the data — not retry or report a server outage.

How do I prevent 508 errors in WebDAV deployments?

Three approaches: (1) Avoid Depth: infinity requests — use Depth: 1 and implement client-side pagination/recursion with cycle detection. (2) Configure the server to limit maximum recursion depth regardless of the Depth header (Apache mod_dav has LimitRequestBody; Nginx has dav_ext_methods). (3) Audit the file system for symbolic link cycles before exposing via WebDAV — tools like 'find -L -type l' on Linux detect symlink loops. For bind-based cycles in WebDAV, review the BIND operations that created cross-collection references.

Source: RFC 5842 §7.2