fix: respect redirect_to parameter after login

README.md

@@ -170,7 +170,7 @@ By default, WordPress' task manager runs on every page load, which is inadvisabl
 
 ### Authentication with Universal Login
 
-The plugin hands authentication over to Auth0's Universal Login. Visitors sign in through your Auth0 tenant rather than the default WordPress login form, which lets you layer on Auth0 capabilities such as MFA, SSO, Passwordless, and Passkeys without changing your WordPress site. Authentication is turned on with a single "Enable Authentication" toggle once your Domain, Client ID, and Client Secret are configured.
+The plugin hands authentication over to Auth0's Universal Login. Visitors sign in through your Auth0 tenant rather than the default WordPress login form, which lets you layer on Auth0 capabilities such as MFA, SSO, Passwordless, and Passkeys without changing your WordPress site. Authentication is turned on with a single "Enable Authentication" toggle once your Domain, Client ID, and Client Secret are configured. After a successful login, the plugin respects WordPress's standard `redirect_to` parameter. If a logged-out user visits a protected page, they are returned to that page after authenticating.
 
 ### WordPress user management
 

src/Actions/Authentication.php

@@ -536,7 +536,20 @@ public function onLogin(): void
                     wp_set_current_user($wpUser->ID);
                     wp_set_auth_cookie($wpUser->ID, true);
                     do_action('wp_login', $wpUser->user_login, $wpUser);
-                    wp_redirect('/');
+
+                    $destination = get_site_url();
+
+                    if (null !== $state) {
+                        $transientKey = 'auth0_redirect_' . hash('sha256', $state);
+                        $stored = get_transient($transientKey);
+
+                        if (false !== $stored) {
+                            delete_transient($transientKey);
+                            $destination = (string) $stored;
+                        }
+                    }
+
+                    wp_redirect($destination);
                     exit;
                 }
             }
@@ -548,11 +561,26 @@ public function onLogin(): void
         }
 
         if ($exchangeParameters && null === $error && (0 !== wp_get_current_user()->ID || null !== $this->getSdk()->getCredentials())) {
-            wp_redirect('/');
+            if (null !== $state) {
+                delete_transient('auth0_redirect_' . hash('sha256', $state));
+            }
+            wp_redirect(get_site_url());
             exit;
         }
 
-        wp_redirect($this->getSdk()->login());
+        $loginParams = [];
+
+        if (isset($_REQUEST['redirect_to']) && is_string($_REQUEST['redirect_to'])) {
+            $redirectTo = wp_validate_redirect(esc_url_raw($_REQUEST['redirect_to']), '');
+
+            if ('' !== $redirectTo) {
+                $stateKey = wp_generate_password(32, false);
+                set_transient('auth0_redirect_' . hash('sha256', $stateKey), $redirectTo, 10 * MINUTE_IN_SECONDS);
+                $loginParams['state'] = $stateKey;
+            }
+        }
+
+        wp_redirect($this->getSdk()->login(params: $loginParams));
         exit;
     }