fix: show error page when Auth0 returns a login error - #967
Merged
Merged
Conversation
When Auth0 returns ?error= on the login callback, the plugin was silently redirecting to /. Reads error_description alongside error, fires a new auth0_login_failed hook, and calls wp_die() with a fixed generic message. Same treatment for onExchangeFailed() which also silently redirected. Default handler shows a fixed message rather than request-supplied values - both parameters are attacker-controllable (reflected content injection). Hook passes sanitized $error and $errorDescription for custom handlers.
4 tasks
nandan-bhat
reviewed
Sep 23, 2026
| } | ||
|
|
||
| public function onExchangeFailed(Throwable $_) | ||
| public function onLoginFailed(string $error, string $errorDescription): void |
There was a problem hiding this comment.
Small thing: $error and $errorDescription are not used here, and Psalm (in the dev deps) may flag them as unused. Maybe reference them or add a suppression. Also this message says log in while onExchangeFailed says sign-in, worth keeping the wording consistent.
- Strip CR/LF from error and description before error_log to prevent log line injection - Prefix unused onLoginFailed params with _ to satisfy static analysis - Unify error message wording between onLoginFailed and onExchangeFailed - Extend registry to support optional priority in [method, args, priority] format - Register onLoginFailed at priority 20 so custom handlers at the default priority 10 run first
# Conflicts: # src/Actions/Authentication.php
nandan-bhat
approved these changes
Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When Auth0 returns an error on the login callback (`?error=access_denied`, blocked account,
breached-password policy, a Login Action denying access, etc.), the plugin was silently
redirecting to the site root with no message shown. The same behavior applied when the OAuth
token exchange threw an exception. The default handler uses a fixed generic message rather
than the request-supplied `error_description` - both parameters are attacker-controllable
and displaying them verbatim would allow arbitrary text to appear on the login page without
going through Auth0.
Changes
References
Closes #964
Testing
Tested manually against the Docker environment (auth0-PHP 9.x, WordPress 7.0, PHP 8.4).
Checklist