Hardening: plain-http wp-login.php redirect loop under FORCE_SSL_ADMIN #16

New issue

Closed

opened 2026-10-15 22:38:58 -07:00 by eric · 0 comments

eric commented

2026-10-15 22:38:58 -07:00

Owner

Type: hardening / availability (fails closed). Found by security audit run 3 (commit 01195c8) in a local lab. Shares the root cause of #9.

What happens

Under FORCE_SSL_ADMIN, core's wp-login.php and auth_redirect() issue an https-upgrade redirect for plain-http requests. RedirectGuard::filterRedirect (src/Rewrite/RedirectGuard.php:31-38) passes that Location through UrlRewriter::rewrite, which replaces the scheme with the request scheme (src/Rewrite/UrlRewriter.php:61), so the upgrade redirect points back to http:// and the browser loops. No credentials are sent (it fails closed), but login and wp-admin are unavailable over plain http.

Suggested fix

The never-downgrade rule proposed in #9 (keep https when the input URL is https, for clearnet hosts) also fixes this. Add a regression test: filterRedirect('https://<configured>/wp-login.php') on an http request returns https.

**Type:** hardening / availability (fails closed). Found by security audit run 3 (commit `01195c8`) in a local lab. Shares the root cause of #9. ## What happens Under `FORCE_SSL_ADMIN`, core's `wp-login.php` and `auth_redirect()` issue an https-upgrade redirect for plain-http requests. `RedirectGuard::filterRedirect` (`src/Rewrite/RedirectGuard.php:31-38`) passes that `Location` through `UrlRewriter::rewrite`, which replaces the scheme with the request scheme (`src/Rewrite/UrlRewriter.php:61`), so the upgrade redirect points back to `http://` and the browser loops. No credentials are sent (it fails closed), but login and wp-admin are unavailable over plain http. ## Suggested fix The never-downgrade rule proposed in #9 (keep https when the input URL is https, for clearnet hosts) also fixes this. Add a regression test: `filterRedirect('https://<configured>/wp-login.php')` on an http request returns https.

eric added the

enhancement

security

labels

2026-10-15 22:38:58 -07:00

eric referenced this issue from a commit

2026-10-16 13:05:34 -07:00

test: cover the FORCE_SSL_ADMIN https-upgrade redirect

eric closed this issue

2026-10-16 13:05:34 -07:00

eric referenced this issue

2026-10-16 13:08:36 -07:00