Changeset 14486 for sites/trunk/common/includes/wporg-sso/wp-plugin.php

Timestamp:

07/16/2025 02:29:30 AM (13 months ago)

Author:

dd32

Message:

SSO: Improve the logout process for non-WordPress domains (Such as BuddyPress and WordCamp).

This resolves some edge-cases where if your cookies on WordPress.org & WordCamp.org became out-of-sync using two different sessions (or you lost your wporg cookies, but retained wcorg) it would become impossible to logout properly.

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (3 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -582 +582 @@
                         );
 
+                        /*
+                         * If we're not on the SSO cookie host, clear the cookies locally before redirecting.
+                         * Upon redirect back, these previous cookies should be invalid as the session is destroyed.
+                         */
+                        if ( $this->sso_cookie_host !== COOKIE_DOMAIN ) {
+                                wp_clear_auth_cookie();
+                        }
+
                         $this->_safe_redirect( $remote_logout_url );
                         exit;
@@ -686 +694 @@
                 /**
                  * Log out a user and destroy the session.
+                 *
+                 * NOTE: This handles `action=remote-logout` requests. The remote-logout query var
+                 *       is not actually used, but is present as a legacy of previous implementations.
                  */
                 protected function _maybe_perform_remote_logout() {
@@ -699 +710 @@
                         }
 
-                        // Perform the logout. This will destroy the session, logging the user out of all sites.
+                        // If the session noted in the remote-logout is different from current, destroy that session first.
+                        $current_token = wp_get_session_token();
+                        if (
+                                $remote_token['session_token'] &&
+                                wp_get_session_token() !== $remote_token['session_token']
+                        ) {
+                                $manager = WP_Session_Tokens::get_instance( $remote_token['user']->ID );
+                                $manager->destroy( $remote_token['session_token'] );
+                        }
+
+                        // Perform the logout. This will destroy the *current* session, logging the user out of all sites.
                         wp_logout();