# בעיה עם WordPress 
 Discourse SSO עבור משתמשים מחוברים

**URL:** <https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770>\
**Category:** WordPress\
**Created:** [11 במרץ,‏ 2023,‏ 2:55am UTC](https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770 "2023-03-11T02:55:37Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![smileBeda](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/smilebeda/32/272497_2.png) [@smileBeda](https://meta.discourse.org/u/smileBeda)\
**Post date:** [13 במרץ,‏ 2023,‏ 8:23am UTC](https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770/8 "2023-03-13T08:23:35Z")

</div>

Perhaps it was not clear:

1. A Discourse forum activates the setting in discourse to allow “any return path”
2. This means now you can visit your-discourse.tld/session/sso?return\_path=ANYTHING
3. ANYTHING might be an external URL

Thus this opens a security vulnerability in terms of at least a phishing attempt could be staged:

- malicious website crafts a button saying “go to the amazing community!”
- the button link is your-discourse.tld/session/sso?return\_path=BACK TO MALICIOUS SITE
- the user presses button, logs in on the community, that leads them back to MALICIOUS SITE
- there, the malicious actor implemented a page that looks exactly like the community and says "something went wrong while you logged in, please try again
- the user submits a nice looking login form that matches the community looks

The malicious actor now has caught the login data?

Thus probably the setting the setting the setting “any return path” shouldn’t be used ever for a site that has users logging in, unless each and every user knows exactly what to look out for.

Would you see that risk too?  
Why could Discourse developers crafting plugins/code that can interact with this setting not be able to give a nod into “yes no problem” or “hell no”?  
It is not that a lot of things can change in that URL parameter. It is either there or not, either it allows externals or not.

Perhaps I am poking into an area I shouldn’t, as in “do not discuss security issues here”? I would understand that of course, many platforms do not allow talking openly about potential security issues that are not clearly defined when enabling them 🙂

---

_[View the full topic](https://meta.discourse.org/t/problem-with-wordpress-discourse-sso-for-logged-in-users/257770)._