Improper Redirect after 2FA Login

  • jasontorrence

    (@jasontorrence)


    2 years, 2 months ago

    We have a site with login redirects based on custom user roles. The post-2FA redirect works fine for the vast majority of users, but it redirects some cases to wp-login.php, which is not an ideal experience for non-admin users.

    When the user who reported the bug performs a login with 2fa, he’s being redirected to wp-admin instead of the intended page.

    Initially, it seemed only reproducible with this user. Upon inspection, though, the logistics seem to point out to bad handling on it-security / solid-wp part. Please refer to the screenshot linked below:

    Screenshot here:

    In the screenshot, note the continued polling to admin-ajax.php and an actual, proper redirect to project-directors page, which just seems to be in a race condition with the subsequent requests to admin-ajax.php, which return some sort of “state not found” error, which results in a secondary POST to wp-login.php, which, then redirects improperly to wp-admin.

    The site is running php 7.4.33, WP 6.5.4, and the latest versions of all plugins, including Solid Security 9.3.3.

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Support chandelierrr

    (@shanedelierrr)

    2 years, 2 months ago

    Hi @jasontorrence, glad you reached out!

    Solid Security’s 2FA is built on default WP login pages, so I’m not surprised with the redirect to the wp-login.php/wp-admin pages.

    For customizations, the login_redirect filter can be used (the plugin captures the redirect_to query), and depending on how it’s implemented, it will work for cases like yours where specific roles are to be redirected to other pages.

    Would you mind sharing how you implemented the login redirect? Are you using a specific plugin or is it through a custom code snippet? Since it works for most of your users, can you confirm if the issue happens on specific custom roles or also to regular WP roles?

    I’m not certain this is an issue with how Solid Security handles redirects yet, but getting it replicable on our end would help us look into this further.

    madhazelnut

    (@madhazelnut)

    2 years, 2 months ago

    @chandelierrr

    the issue is reproducible on latest stock-WP/Solid-Security combination. Steps:

    1. Add Solid Security Basic to a fresh install wp plugin install --activate better-wp-security
    2. Enable 2fa
    3. Create a non-admin user and enroll in 2fa (I used email)
    4. activate bug reproduction code: https://gist.github.com/slavicd/52d76d0f988aee63147ae3594aeee946
    5. Log in with the newly created user.

    Expected result: the user is redirected to the first published post after login.

    Actual result: the user is being redirected to wp-admin, instead (with visible, cancelled redirect to ?p=1 in browser inspector).

    Reproduction code copied here, as well, for ticket self-sufficiency.

    <?php
    /*
    Plugin Name: Solid WP redirect bug reproduction
    Description: https://wordpress.org/support/topic/improper-redirect-after-2fa-login/
    Author: Slavic Dragovtev <slavic@entropi.dev>
    Version: 0.1.0
    */

    add_action('the_post', function() {
        // this should allow enough time for the bug to manifest itself
        sleep(12);
    });

    add_filter('login_redirect', function($redirect_to, $request, $user){
        return home_url('?p=1');
    }, 15, 3);

    A screen recording of the bug can presently be viewed here: https://entropi.dev/share/84783443HD3/solid-wp-bug.webm

    • This reply was modified 2 years, 2 months ago by madhazelnut. Reason: added code and screencast
Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Improper Redirect after 2FA Login’ is closed to new replies.