Using the auth0 word in the URL path triggers an authorization code exchange

[jmangelo]

Steps to reproduce:

• Configure a page to have a URL like http://[wp_authority]/auth0test/;
• Configure the WP plugin to have Login redirection URL set to http://[wp_authority]/auth0test/;
• Perform a end-user login

The above flow will trigger a second authorization code exchange when navigating to http://[wp_authority]/auth0test/; since there's no code available on that URL, the exchange will fail and appear in the Auth0 logs as a failed one due to Missing required parameter: code.

It seems that having auth0 in the URL will trigger the code exchange to be executed as doing the above flow with http://[wp_authority]/thisisatest/ will not cause any additional code exchange.

[joshcanhelp]

@jmangelo - Thanks for the report here and I can confirm this behavior.

[cocojoe]

I think the interim fix was not to used auth0 in the path 😄
Longer term, improve the matching.

[aslafy-z]

Sounds like a easy fix: https://github.com/auth0/wp-auth0/blob/master/lib/WP_Auth0_Routes.php#L23

[joshcanhelp]

Thanks for the digging @aslafy-z ... the fix is easy but just removing it might be breaking. I'll see if I can make this change without harming anyone 👍

[joshcanhelp]

Have to punt this to the major release, planned for early next year. I've not been able to find a simple way to keep this route as a functional callback for sites still using it so removing outright would be a breaking change.