Discourse SSO with Wordpress Only Works with /core/wp-admin URL

AI-generated summary

The original poster, benbowler, is experiencing issues with Discourse SSO only working on their live Wordpress site when the redirect_url is set to the /core/wp-admin URL. itsbhanusharma suspects a misconfigured reverse proxy, and benbowler confirms they are using Cloudflare. pfaffman suggests turning off the orange cloud, but benbowler notes this is not feasible as Cloudflare is used as a primary cache. pfaffman and itsbhanusharma recommend disabling Cloudflare’s “performance” and “rocket loader” features or using it only as a CDN. As a temporary workaround, benbowler has written a redirect script to always redirect to /core/wp-admin and then use a final redirect to the desired URL. simon inquires about the Wordpress plugin being used, suggesting it might be related to the issue.

I’ve deployed a new Wordpress plugin that relies on Discourse’s SSO but I’ve got a strange bug that only effects the live deployment of the site.

On local I can login and use the redirect_url parameter to get back to the page. However on the live site SSO only works if the redirect_url is the wp-admin URL eg.:

SSO Works great…
https://www.example.com/core/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fcore%2Fwp-admin%2F&reauth=1

SSO Doesn’t successfully auth, it just returns to the login/post
https://www.example.com/core/wp-login.php

Have you come across this before, any ideas where to look? If it persists I’ll have to build my own redirection mechanism to catch wp-admin

I’m pretty confident that there is either a misconfigured reverse proxy or similar shenanigan at play here. Are you using cloudflare by any chance?

Yes it’s Cloudflare - are there any settings in Cloudflare we can test.

Turn off the orange cloud.

Haha, that’s not my decision, the site uses Cloudflare as a primary cache. I’ll have to do some research into reverse proxies and see if I can adjust any of the settings in CF

There are dozens of topics about problems caused by cloudflare’s optimizations. You could use couldflare as a CDN, and that would have discourse redirect only stuff that can be cached through cloudflare.

You could also temporarily disable it and see whether that solves the problem.

Simply disable cloudflare “performance” and “rocket loader” on discourse through page rules that should most probably fix it for you

Yes, this is a strange mixture of issues, partially down to the WP installation director it seems as well. I’ve written a work around for now that always redirects to /core/wp-admin then there’s a final ?final_redirect_url that my own hook picks up and actions to take us back to where we want to be.

It looks like you are using WP Discourse – WordPress plugin | WordPress.org with the SSO Client option enabled (Discourse is the SSO provider.) Can you confirm that this is the case?