Context Navigation

← Previous Changeset
Next Changeset →

Changeset 14486

Timestamp:

07/16/2025 02:29:30 AM (12 months ago)

Author:

dd32

Message:

SSO: Improve the logout process for non-WordPress domains (Such as BuddyPress and WordCamp).

This resolves some edge-cases where if your cookies on WordPress.org & WordCamp.org became out-of-sync using two different sessions (or you lost your wporg cookies, but retained wcorg) it would become impossible to logout properly.

Location:

sites/trunk/common/includes/wporg-sso

Files:

: 2 edited

class-wporg-sso.php (modified) (2 diffs)
wp-plugin.php (modified) (3 diffs)

Legend:

: Unmodified
: Added
: Removed

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

-              r14340
+              r14486
                 ];
+                public $sso_host       = 'login.wordpress.org';
+                public $sso_host_url   = '';
+                public $sso_login_url  = '';
+                public $sso_signup_url = '';
+                public $sso_host        = 'login.wordpress.org';
+                public $sso_cookie_host = '.wordpress.org';
+                public $sso_host_url    = '';
+                public $sso_login_url   = '';
+                public $sso_signup_url  = '';
                 public $host   = '';
 …
                                         $this->sso_host .= ':' . parse_url( home_url(), PHP_URL_PORT );
+                                }
+                                $this->sso_cookie_host = defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : '';
                         } else {
                                 $this->sso_host_url = 'https://' . $this->sso_host;

sites/trunk/common/includes/wporg-sso/wp-plugin.php

-              r14446
+              r14486
                         );
+                        /*
+                         * If we're not on the SSO cookie host, clear the cookies locally before redirecting.
+                         * Upon redirect back, these previous cookies should be invalid as the session is destroyed.
+                         */
+                        if ( $this->sso_cookie_host !== COOKIE_DOMAIN ) {
+                                wp_clear_auth_cookie();
+                        }
                         $this->_safe_redirect( $remote_logout_url );
                         exit;
 …
                 /**
                  * Log out a user and destroy the session.
+                 *
+                 * NOTE: This handles `action=remote-logout` requests. The remote-logout query var
+                 *       is not actually used, but is present as a legacy of previous implementations.
                  */
                 protected function _maybe_perform_remote_logout() {
 …
+                        }
+                        // Perform the logout. This will destroy the session, logging the user out of all sites.
+                        // If the session noted in the remote-logout is different from current, destroy that session first.
+                        $current_token = wp_get_session_token();
+                        if (
+                                $remote_token['session_token'] &&
+                                wp_get_session_token() !== $remote_token['session_token']
+                        ) {
+                                $manager = WP_Session_Tokens::get_instance( $remote_token['user']->ID );
+                                $manager->destroy( $remote_token['session_token'] );
+                        }
+                        // Perform the logout. This will destroy the *current* session, logging the user out of all sites.
                         wp_logout();

Note: See TracChangeset for help on using the changeset viewer.

Making WordPress.org

Context Navigation

Changeset 14486

Legend:

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

sites/trunk/common/includes/wporg-sso/wp-plugin.php

Download in other formats: