WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am developing a plugin which allows to link a local wordpress account to a two-factor authentication service.

The login and linking flow works perfectly in Chrome and IE, but the redirects result in a white page in Firefox. Strangely, there is no error whatsoever, as all code is executed and a simple F5 refresh of the page shows the correct page.

As you can see in the code below, I am only using a wp_redirect() once to trigger the authentication flow, which works and is not the problem. From there on it's Wordpress who handles all redirects and does so nicely in Chrome and IE but fails in Firefox

public function myplugin_callback() {
    global $wp_query;

    if ($wp_query->get('code')) {
        $_SESSION['code'] = $wp_query->get('code');
        $_SESSION['state'] = $wp_query->get('state');

        wp_redirect(site_url('wp-login.php', 'login'));
        echo 'Please wait, logging in.';

public function myplugin_authenticate($user, $username) {
    // do the authentication here
    if (isset($_SESSION['code'])) {
        /* get userdata via OAuth here */

        if (isset($userData['email'])) {
            $userSearch = get_user_by('email', $userData['email']);

            if ($userSearch) { // user exists
                $uuid = get_user_meta($userSearch->ID, 'myplugin_uuid', true);
                if ($uuid == $userData['uuid']) { // user is linked
                    $user = new WP_User($userSearch->ID);
                } else { // user is not linked
                    $_SESSION['myplugin-data'] = serialize($userData);
                    $user = new WP_Error('denied', __('You already have an account with this email on this blog. Please log in to link this account with our service.'));
                    remove_action('authenticate', 'wp_authenticate_username_password', 20);
            } else { // user does not exist
                $user = new WP_Error();
    } else { // local login
        $userSearch = get_user_by('login', $username);

        if ($userSearch) {
            $uuid = get_user_meta($userSearch->ID, 'myplugin_uuid', true);

            if (!isset($_SESSION['myplugin-data']) && !empty($uuid) && !$this->myPluginHelper()->getlocalAuthAllowed()) {
                $user = new WP_Error('denied', __('Local login disabled. Please use myPlugin to log in.'), 'message');
                remove_action('authenticate', 'wp_authenticate_username_password', 20);
            } else {
                add_filter('login_redirect', array($this, 'save_myplugin_uuid'), 10, 3);
    return $user;

public function save_myplugin_uuid($redirect_to, $request, $user) {
    if (isset($_SESSION['myplugin-data']) && is_a($user, 'WP_User')) {
        $userData = unserialize($_SESSION['myplugin-data']);
        update_usermeta($user->ID, 'myplugin_uuid', $userData['uuid']);
    return $redirect_to;

I have Googled quite a deal, to no avail. Does anyone have an idea?

Thanks Jeroen

share|improve this question

Just like I thought (and had tested on Chrome and IE) the code is rock-solid.

This turned out to be an issue with our company's proxy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.