9

I'm trying to login to stackoverflow using my wordpress openID. When I'm redirected back, I see the message

Redirects on POST requests that are to untrusted servers is not supported.

Is it by design or it's a bug?

Improve this question
16
  • 1
    Hmm. Certainly not by design. We like people to be able to actually log in with the credential providers we support. :)
    – Adam Lear StaffMod
    Dec 22, 2014 at 22:38
  • 1
    @AnnaLear Likely the Wordpress endpoint sending a redirect to change the HTTP connection to HTTPS, the URL on the OpenID selector just needs to be updated to have the right scheme in that case (it's still http://{username}.wordpress.com/).
    – Tim Stone
    Dec 23, 2014 at 1:21
  • @TimStone Alas, not quite. (Test it by pasting an https Wordpress URL into the OpenID box.) Not sure what changed there recently - I'm digging, but I'm also having trouble finding the code for version of DotNetOpenAuth that we're using so I can properly debug.
    – Adam Lear StaffMod
    Dec 24, 2014 at 19:36
  • @AnnaLear Ah hrm (I didn't test because I don't have a Wordpress OpenID). The error is expected for any provider that sends back a redirect during verification, but not sure why that'd happen off-hand if not for a HTTPS redirect. :(
    – Tim Stone
    Dec 24, 2014 at 19:40
  • @AnnaLear Oh, huh, actually I can't repro this at all.
    – Tim Stone
    Dec 24, 2014 at 19:49
  • @TimStone Wait, really? I get it reliably every time.
    – Adam Lear StaffMod
    Dec 24, 2014 at 19:51
  • @AnnaLear Well...I tried adding it as a login to an existing account, let me make sure it works as well actually logging in (sorry, didn't consider there might be a difference before commenting).
    – Tim Stone
    Dec 24, 2014 at 19:58
  • @AnnaLear Yeah, no repro. Using the WordPress option actually has the weird behaviour of not sending an OpenID Provider (I get an error with "No OpenID identifier was provided"), but I'm on Chrome dev so that might just be me. Using the http://{username}.wordpress.com/ URL as a manual endpoint works fine for logging in.
    – Tim Stone
    Dec 24, 2014 at 20:06
  • @TimStone Great. I can't repro the former (not sending a provider), but can the latter. Fun!
    – Adam Lear StaffMod
    Dec 24, 2014 at 20:19
  • @AnnaLear Ah, it happens when the "more login options" is auto-expanded to your preferred provider. If you don't manually reselect the option openid.provider_url isn't populated for use in the submit handler. I can open a separate bug if it hasn't been reported before.
    – Tim Stone
    Dec 24, 2014 at 20:53
  • @TimStone Please do. Thanks!
    – Adam Lear StaffMod
    Dec 24, 2014 at 20:54
  • @Antonio Just to confirm a theory... do you have a custom domain pointing to your Wordpress blog?
    – Adam Lear StaffMod
    Dec 24, 2014 at 21:11
  • Yes, I have a custom domain and it is the primary one
    – Antonio
    Dec 26, 2014 at 20:54
  • @Anna it is still happening, any updates?
    – Shadow Wizard Strikes Back
    Feb 7, 2015 at 0:04
  • So is there any workaround? I use wordpress to auth, and I'm down to one device I have access on, and as a diamond mod it'd be kinda sad if I can't even get onto my own site. I tried making a SE login with the same email but they're not linked up.
    – mxyzplk
    Feb 17, 2015 at 3:16

1 Answer 1

Reset to default
2

Sadly, no progress right now beyond identifying that this is related to the domain redirect... somehow. I suspect it may have to be something broken on Wordpress's end.

I haven't been able to track down the source code for the exact version of dotNetOpenAuth we use, which stalled my debugging efforts. I'll try to set aside some time to give it another shot soon. I'll update this answer if/when there are any news to report.

Improve this answer
4
  • 1
    Really we should just yell at WordPress for performing that redirect on the last leg of the auth process, but it seems this setup has been broken for years. Not sure if there's any workaround though, since DNOA unconditionally bails if the redirect is on a POST.
    – Tim Stone
    Feb 7, 2015 at 3:02
  • @TimStone I'd love nothing more than for this to be an old bug, but alas... it used to work very recently. Not sure what changed off-hand.
    – Adam Lear StaffMod
    Feb 7, 2015 at 3:04
  • You can yell at WordPress here: en.forums.wordpress.com/topic/…
    – pauldendulk
    Sep 12, 2015 at 11:00
  • 2
    A possible workaround: If you have an e-mail address in your stackoverflow profile you can use this to 'reset your password' even if you never used this to log in.
    – pauldendulk
    Sep 12, 2015 at 11:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .