9

I'm trying to login to stackoverflow using my wordpress openID. When I'm redirected back, I see the message

Redirects on POST requests that are to untrusted servers is not supported.

Is it by design or it's a bug?

  • 1
    Hmm. Certainly not by design. We like people to be able to actually log in with the credential providers we support. :) – Adam Lear Dec 22 '14 at 22:38
  • 1
    @AnnaLear Likely the Wordpress endpoint sending a redirect to change the HTTP connection to HTTPS, the URL on the OpenID selector just needs to be updated to have the right scheme in that case (it's still http://{username}.wordpress.com/). – Tim Stone Dec 23 '14 at 1:21
  • @TimStone Alas, not quite. (Test it by pasting an https Wordpress URL into the OpenID box.) Not sure what changed there recently - I'm digging, but I'm also having trouble finding the code for version of DotNetOpenAuth that we're using so I can properly debug. – Adam Lear Dec 24 '14 at 19:36
  • @AnnaLear Ah hrm (I didn't test because I don't have a Wordpress OpenID). The error is expected for any provider that sends back a redirect during verification, but not sure why that'd happen off-hand if not for a HTTPS redirect. :( – Tim Stone Dec 24 '14 at 19:40
  • @AnnaLear Oh, huh, actually I can't repro this at all. – Tim Stone Dec 24 '14 at 19:49
  • @TimStone Wait, really? I get it reliably every time. – Adam Lear Dec 24 '14 at 19:51
  • @AnnaLear Well...I tried adding it as a login to an existing account, let me make sure it works as well actually logging in (sorry, didn't consider there might be a difference before commenting). – Tim Stone Dec 24 '14 at 19:58
  • @AnnaLear Yeah, no repro. Using the WordPress option actually has the weird behaviour of not sending an OpenID Provider (I get an error with "No OpenID identifier was provided"), but I'm on Chrome dev so that might just be me. Using the http://{username}.wordpress.com/ URL as a manual endpoint works fine for logging in. – Tim Stone Dec 24 '14 at 20:06
  • @TimStone Great. I can't repro the former (not sending a provider), but can the latter. Fun! – Adam Lear Dec 24 '14 at 20:19
  • @AnnaLear Ah, it happens when the "more login options" is auto-expanded to your preferred provider. If you don't manually reselect the option openid.provider_url isn't populated for use in the submit handler. I can open a separate bug if it hasn't been reported before. – Tim Stone Dec 24 '14 at 20:53
  • @TimStone Please do. Thanks! – Adam Lear Dec 24 '14 at 20:54
  • @Antonio Just to confirm a theory... do you have a custom domain pointing to your Wordpress blog? – Adam Lear Dec 24 '14 at 21:11
  • Yes, I have a custom domain and it is the primary one – Antonio Dec 26 '14 at 20:54
  • @Anna it is still happening, any updates? – Shadow The Princess Wizard Feb 7 '15 at 0:04
  • So is there any workaround? I use wordpress to auth, and I'm down to one device I have access on, and as a diamond mod it'd be kinda sad if I can't even get onto my own site. I tried making a SE login with the same email but they're not linked up. – mxyzplk says reinstate Monica Feb 17 '15 at 3:16
2

Sadly, no progress right now beyond identifying that this is related to the domain redirect... somehow. I suspect it may have to be something broken on Wordpress's end.

I haven't been able to track down the source code for the exact version of dotNetOpenAuth we use, which stalled my debugging efforts. I'll try to set aside some time to give it another shot soon. I'll update this answer if/when there are any news to report.

  • 1
    Really we should just yell at WordPress for performing that redirect on the last leg of the auth process, but it seems this setup has been broken for years. Not sure if there's any workaround though, since DNOA unconditionally bails if the redirect is on a POST. – Tim Stone Feb 7 '15 at 3:02
  • @TimStone I'd love nothing more than for this to be an old bug, but alas... it used to work very recently. Not sure what changed off-hand. – Adam Lear Feb 7 '15 at 3:04
  • You can yell at WordPress here: en.forums.wordpress.com/topic/… – pauldendulk Sep 12 '15 at 11:00
  • 2
    A possible workaround: If you have an e-mail address in your stackoverflow profile you can use this to 'reset your password' even if you never used this to log in. – pauldendulk Sep 12 '15 at 11:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .