Skip to content

onLogin() silently discards Auth0 error responses #964

Description

@hanifn

Checklist

  • I have looked into the Readme and the documentation, and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.

Description

When Auth0 returns an error/error_description on the login callback (expired password, breached-password block, blocked account, etc.), onLogin() redirects to / and exits with no message shown. v4's equivalent (WP_Auth0_LoginManager::die_on_login()) displayed "There was a problem with your log in: {description} [error code: {code}]".
Expected: some indication is shown to the user that login failed and why.

Reproduction

  1. Trigger any Auth0-side login error (e.g. visit wp-login.php?error=access_denied&error_description=test&state=<valid-state>, or trigger a real rejection like a blocked/breached-password account).
  2. Observe the browser is redirected to / with no error message, indistinguishable from a no-op.

Additional context

// line ~545-548
if (null !== $error) {
    wp_redirect('/');
    exit;
}

wp-auth0 version

5.6.1

WordPress version

7.1

PHP version

8.4

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions