Discourse doesn't redirect to return_sso_url after user logs in on private site

Product Support
3

Since you mentioned it, I decided to test the wp-discourse plugin as well. We currently use it for login to our wordpress site without issue, however having just now tested it inside of an incognito window I see that I’m getting the same exact behavior of no redirect back to wordpress after using the twitter login!

I’m really not sure what is different here. I used the chrome inspector to pick out the requests and here’s what I found:

  • Clicking on the django app’s ‘login with discourse’ button redirects me to /session/sso_provider?sig=bc16879aa51daa815318c1de6acdf8adb85f6e778d1e739334dd425a8b047b2d&sso=bm9uY2U9ODEwOTg1NzkmcmV0dXJuX3Nzb191cmw9aHR0cHM6Ly9vcmdhbml6aW5nLmVhc3RiYXlmb3JldmVyeW9uZS5vcmcvY29tcGxldGUvZGlzY291cnNlLw%3D%3D
  • Discourse responds to that request with a 302 redirect to /login, and sets the sso_payload cookie to sig%3Dbc16879aa51daa815318c1de6acdf8adb85f6e778d1e739334dd425a8b047b2d%26sso%3Dbm9uY2U9ODEwOTg1NzkmcmV0dXJuX3Nzb191cmw9aHR0cHM6Ly9vcmdhbml6aW5nLmVhc3RiYXlmb3JldmVyeW9uZS5vcmcvY29tcGxldGUvZGlzY291cnNlLw%253D%253D
  • Following the redirect, my browser sends sig%3Dbc16879aa51daa815318c1de6acdf8adb85f6e778d1e739334dd425a8b047b2d%26sso%3Dbm9uY2U9ODEwOTg1NzkmcmV0dXJuX3Nzb191cmw9aHR0cHM6Ly9vcmdhbml6aW5nLmVhc3RiYXlmb3JldmVyeW9uZS5vcmcvY29tcGxldGUvZGlzY291cnNlLw%253D%253D for the sso_payload cookie.
  • At this point, I’m looking at the “please login to discourse” screen. I click the login button, then the twitter button in the pop-up.
  • I sign in with my twitter account
  • The same song and dance happens, and my browser ends up requesting / from the discourse app, while sending the sso_payload cookie of sso_payload=sig%3Dbc16879aa51daa815318c1de6acdf8adb85f6e778d1e739334dd425a8b047b2d%26sso%3Dbm9uY2U9ODEwOTg1NzkmcmV0dXJuX3Nzb191cmw9aHR0cHM6Ly9vcmdhbml6aW5nLmVhc3RiYXlmb3JldmVyeW9uZS5vcmcvY29tcGxldGUvZGlzY291cnNlLw%253D%253D
  • I am never redirected to my django app.

In every step, the cookie seems intact and I can base64 decode it to generate the proper sso_payload. Here is one such payload: nonce=81098579&return_sso_url=http://localhost:8000/complete/discourse/

Should I be urlencoding the return_sso_url parameter as well? That isn’t mentioned in the documentation, so I’m currently not doing; modifying my django app to urlencode it also does not change this behavior and still gets me no redirects. That also wouldn’t explain why our wordpress plugin isn’t getting redirects either.

After re-reading your post though, I’m wondering if you’re testing using username+password logins instead of twitter logins. We have password logins turned off and the only way you can login to our discourse is through twitter. That might explain the differences.