I am working on a WordPress website that has a Discourse Forum connected to it with approximately 200K users. Using the OAuth Single Sign On - SSO (OAuth client) and WP-Discourse plugins, we connect the posts from WP to discourse and have the users Login on WP with their WP User instance which then…

Hello @smileBeda , [صورة] Beda: Why is this not more widely documented, if it were to be the actual expected approach? You can check out the documentation here: [صورة] Configure single sign-on (SSO) with WP Discourse and DiscourseConnect Administrators …

Thanks @angus for this confirmation While it still feels weird, I’ve gone ahead and added a redirect to the session/sso?return_path= on user login in wp The return path I’ve set to the referrer from wp (if any) or the wp homepage That works great and makes sure the user is logged in on both insta…

[صورة] Beda: While it still feels weird, I’ve gone ahead and added a redirect to the session/sso?return_path= on user login in wp Typically I advise clients against doing an automatic redirect like this. I understand why you feel this is an issue, it’s a not uncommon feeling, however the stan…

[صورة] Angus McLeod: No, with the caveat that I would question the premise of needing it. But without more information I can’t see an issue with using it. Could this be an invalidated redirect risk, such as described here? Unvalidated Redirects and Forwards - OWASP Cheat Sheet Serie…

@Angus - any chance you have some insight on the last doubt above? Thank you!

Sorry, that would be straying into giving you advice on a sensitive part of your setup without seeing it for myself, or having a defined relationship with you. Particularly give the size of your forum, and the relevant regulations that apply to it, I’d recommend you get specific, informed, advice o…

Perhaps it was not clear: A Discourse forum activates the setting in discourse to allow “any return path” This means now you can visit your-discourse.tld/session/sso?return_path=ANYTHING ANYTHING might be an external URL Thus this opens a security vulnerability in terms of at least a phishing att…

I think you’ve already answered your own question. [صورة] Beda: Why could Discourse developers crafting plugins/code that can interact with this setting not be able to give a nod into “yes no problem” or “hell no”? Because the valence of settings depends on how they’re used, indeed that’s wh…

مشكلة في WordPress <> Discourse SSO للمستخدمين المسجلين

الدعم WordPress

angus (Angus McLeod) 11 مارس 2023، 9:32ص 2

مرحباً @smileBeda،

يمكنك الاطلاع على التوثيق هنا:

إذا كنت تريد إعادة توجيه المستخدمين تلقائيًا إلى تسجيل الدخول عند انتقالهم إلى أي مسار في منتداك، فستحتاج إلى تمكين إعداد login required. هذا هو السلوك المتوقع بالفعل.

الموضوع		الردود	مرات العرض
Add links to Discourse that allow users to authenticate via SSO or access private groups directly if they are logged in already WordPress	6	1156	27 يناير 2023
Create a DiscourseConnect login link Integrations sso , discourseconnect , how-to	6	6355	25 سبتمبر 2024
WP and Discourse not in sync using SSO WordPress	15	3763	9 مارس 2017
WP-Discourse Force SSO? WordPress	9	2115	8 ديسمبر 2018
SSO with Wordpress and Discourse as Provider login Flow and logic WordPress	1	1391	1 أغسطس 2019

مشكلة في WordPress <> Discourse SSO للمستخدمين المسجلين

الموضوعات ذات الصلة