# בעיה עם WordPress 
 Discourse SSO עבור משתמשים מחוברים

**URL:** <https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770>\
**Category:** WordPress\
**Created:** [11 במרץ,‏ 2023,‏ 2:55am UTC](https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770 "2023-03-11T02:55:37Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![smileBeda](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/smilebeda/32/272497_2.png) [@smileBeda](https://meta.discourse.org/u/smileBeda)\
**Post date:** [11 במרץ,‏ 2023,‏ 2:55am UTC](https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770/1 "2023-03-11T02:55:37Z")

</div>

I am working on a WordPress website that has a Discourse Forum connected to it with approximately 200K users.  
Using the `OAuth Single Sign On - SSO (OAuth client)` and `WP-Discourse` plugins, we connect the posts from WP to discourse and have the users Login on WP with their WP User instance which then logs them in to Discourse too.

Now, a problem appeared, whenever we set the Discourse settings to **not requiring being logged in**.

These are our steps:

1. User logs in to WordPress
2. User clicks on a link leading to Discourse (a topic, any link leading to Discourse)  
==\> The user now sees Discourse as if they were not logged in! But they are being logged in, the moment they logged into WordPress!
3. Now the user clicks on the Discourse log-in or into any topic link
4. Page refreshes and user is now authenticated!

We have been told, that this is expected, and that we need to do the following:

- when the user is logged in, all links leading to discourse from WordPress _must_ be as follows: `https://our-discourse-instance.com/session/sso?return_path={ORIGINAL URL OF DISCOURSE WE POINT TO, like a topic url, or so}`
- when a user is logged out, we may link to the `{ORIGINAL URL OF DISCOURSE WE POINT TO, like a topic url, or so}` directly, like so `https://our-discourse-instance.com/t/topic-slug`

I strongly suspect that this is the wrong approach to resolve this problem, because:

1. What if a user, while logged into Discourse, copies a topic URL, and shares that url with someone who is as well logged into the WP/DIscourse? They would get the same error as shown above in #2, since no such URL suffix would be appended
2. Why would a _logged in user_ need to be redirected to `session/sso?return_path=`? What is the technical reasoning and logic behind this?
3. Why is it solved as soon the user reloads the page (loads a topic url, pressese login, etc)?
4. Why is this not more widely documented, if it were to be the actual expected approach?
5. Why would that not be mentioned in the API, where we are able to pull any topic URL from discourse, and NO where it is written that logged in users won’t be able to immediately reach the content and first need to do weird reloads, or that we need to append weird URL parameters that do, in fact, not really convert anything?

I would really appreciate some authoritative opinion on this, because I am not convinced at all that this is the expected behaviour!  
If it is, I would like to inquire:

- _why_ this is actually necessary and
- _what is planned to be done in regard_ (because this surely not ideal, see point 1 of my reasons as of why this shouldn’t be expected)

Thank you!

---

_[View the full topic](https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770)._