Conversation
|
Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.
Interested in more tips and information?
|
|
Thank you for your PR! When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:
This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖 Follow this PR Review Process:
If you have questions about anything, reach out in #jetpack-developers for guidance! |
github-actions
bot
added
the
[Status] Needs Author Reply
Code Coverage SummaryCoverage changed in 2 files.
Full summary · PHP report · JS report If appropriate, add one of these labels to override the failing coverage check:
Covered by non-unit tests
|
There was a problem hiding this comment.
Pull request overview
Adds support in the Jetpack Connection SSO flow to redirect through an external SSO broker (e.g., MSD for CIAB stores) when WP.com returns a broker_url in the jetpack.sso.requestNonce XML-RPC response, while keeping the existing validate/login flow unchanged.
Changes:
- Extend
request_initial_nonce()to handle both string and{ nonce, broker_url }responses and cachebroker_urlserver-side in a transient. - Route
build_sso_url()/build_reauth_and_sso_url()through the broker when available via a newget_sso_base_url()helper. - Allow broker host in
allowed_redirect_hosts, and add PHPUnit coverage for broker URL behavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| projects/packages/connection/src/sso/class-sso.php | Parses broker URL from XML-RPC response, caches it in a transient, and uses it as the SSO base URL when present; clears transient on login/disconnect. |
| projects/packages/connection/src/sso/class-helpers.php | Adds the broker host to allowed_redirect_hosts so wp_safe_redirect() can target the broker domain. |
| projects/packages/connection/tests/php/sso/SSO_Broker_Test.php | New tests for broker transient validation, base URL selection, allowed redirect hosts behavior, and transient cleanup. |
| projects/packages/connection/changelog/add-sso-broker-redirect | Changelogger entry documenting the added broker redirect capability. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| $response = $xml->getResponse(); | ||
|
|
||
| // The response may be a plain nonce string (default) or an associative | ||
| // array containing 'nonce' and 'broker_url' for sites that use an | ||
| // external SSO broker (e.g. CIAB stores). | ||
| if ( is_array( $response ) && isset( $response['nonce'] ) ) { | ||
| $nonce = sanitize_key( $response['nonce'] ); | ||
|
|
||
| if ( ! empty( $response['broker_url'] ) ) { | ||
| $broker_url = esc_url_raw( $response['broker_url'] ); | ||
| $url_parts = wp_parse_url( $broker_url ); | ||
|
|
||
| if ( $url_parts && 'https' === ( $url_parts['scheme'] ?? '' ) ) { | ||
| set_transient( self::BROKER_URL_TRANSIENT, $broker_url, 10 * MINUTE_IN_SECONDS ); | ||
| } | ||
| } | ||
| } else { | ||
| $nonce = sanitize_key( $response ); | ||
| } |
There was a problem hiding this comment.
request_initial_nonce() assumes that any array response from jetpack.sso.requestNonce will include a nonce. If WP.com ever returns an array without nonce, the code falls through to sanitize_key( $response ) (array input) or leaves $nonce unset, which can cause PHP errors and set an invalid cookie. Handle the is_array( $response ) case explicitly: if nonce is missing/empty, return a WP_Error (and avoid calling sanitize_key on a non-string).
| set_transient( self::BROKER_URL_TRANSIENT, $broker_url, 10 * MINUTE_IN_SECONDS ); | ||
| } | ||
| } | ||
| } else { | ||
| $nonce = sanitize_key( $response ); |
There was a problem hiding this comment.
When jetpack.sso.requestNonce returns a plain string (non-CIAB), the broker transient is never cleared. That means an old broker_url can remain in jetpack_sso_broker_url and continue to redirect users through the broker even when WP.com no longer returns one. Consider explicitly delete_transient( self::BROKER_URL_TRANSIENT ) when the response is not the { nonce, broker_url } shape, and also when broker_url is present but fails HTTPS/URL validation.
| set_transient( self::BROKER_URL_TRANSIENT, $broker_url, 10 * MINUTE_IN_SECONDS ); | |
| } | |
| } | |
| } else { | |
| $nonce = sanitize_key( $response ); | |
| set_transient( self::BROKER_URL_TRANSIENT, $broker_url, 10 * MINUTE_IN_SECONDS ); | |
| } else { | |
| delete_transient( self::BROKER_URL_TRANSIENT ); | |
| } | |
| } else { | |
| delete_transient( self::BROKER_URL_TRANSIENT ); | |
| } | |
| } else { | |
| $nonce = sanitize_key( $response ); | |
| delete_transient( self::BROKER_URL_TRANSIENT ); |
| public static function get_broker_url() { | ||
| $broker_url = get_transient( self::BROKER_URL_TRANSIENT ); | ||
|
|
||
| if ( ! $broker_url ) { | ||
| return false; | ||
| } | ||
|
|
||
| $url_parts = wp_parse_url( $broker_url ); | ||
| if ( ! $url_parts || 'https' !== ( $url_parts['scheme'] ?? '' ) ) { | ||
| delete_transient( self::BROKER_URL_TRANSIENT ); | ||
| return false; | ||
| } | ||
|
|
||
| return $broker_url; | ||
| } |
There was a problem hiding this comment.
get_broker_url() assumes the transient value is a parseable URL string and only validates the scheme. If the transient is corrupted/non-string, wp_parse_url() can throw a type error under PHP 8+, and if the URL is missing a host (e.g. https:///path) it would still be accepted and later used as the SSO base URL. Consider adding is_string( $broker_url ) and requiring a non-empty host in the validation before returning it (otherwise delete the transient and return false).
When CIAB stores use Jetpack SSO, the redirect currently always goes to wordpress.com, which authenticates using the browser's WP.com session cookie. This can cause account mismatches when the MSD (my.woo.ai) uses OAuth — a merchant can be logged into the MSD as Account A but have a stale WP.com cookie for Account B.
This PR adds support for an external SSO broker URL. When WP.com returns a broker_url in the jetpack.sso.requestNonce XML-RPC response (for CIAB sites), the SSO redirect goes to that broker instead of wordpress.com. The broker (MSD) then authorizes via its OAuth session and redirects back. The existing handle_login / validateResult flow is unchanged.
Related CONNECT-191
Proposed changes:
Other information:
Jetpack product discussion
Does this pull request change what data or activity we track or use?
Testing instructions:
Changelog