fix: respect redirect_to parameter after login - #965
Merged
Merged
Conversation
nandan-bhat
reviewed
Sep 23, 2026
…y-authenticated path - Add is_string() check before esc_url_raw() to prevent a PHP 8 fatal when redirect_to is submitted as an array (redirect_to[]=x) - Delete the redirect transient in the already-authenticated early-return path so it does not linger until TTL expiry - Align the already-authenticated redirect with get_site_url() for Multisite subdirectory installs - Note redirect_to support in README
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
After a successful Auth0 login, the plugin was unconditionally redirecting to
/and ignoring theredirect_toparameter that WordPress passes on the login URL. This is standard WordPress behavior - when a logged-out user visits a protected page, WordPress appends?redirect_to=<destination>to the login URL so they end up back where they started after authenticating. The behavior was present in v4 and dropped in v5.The destination is now captured at login initiation, stored in a WordPress transient keyed by a hash of the OAuth state nonce, and retrieved after the token exchange completes.
wp_validate_redirect()is applied before storing to block off-site redirect attempts. The transient has a 10-minute TTL and is deleted immediately on use.References
Closes #962
Testing
Tested manually against the Docker environment (auth0-PHP 9.3.0, WordPress 7.0, PHP 8.4):
redirect_to=/wp-admin/: after login, browser lands at/wp-admin/. Pass.redirect_toparam: after login, browser lands at/. Fallback correct. Pass.redirect_to=https://evil.com:wp_validate_redirect()blocks the external URL, browser lands at/. Pass.Also verified end-to-end with Redis Object Cache active - transient routes through Redis (
SETEXon login initiation,GET+DELon callback).Checklist