Login redirect shows white page in firefox

Question

I am developing a plugin which allows to link a local wordpress account to a two-factor authentication service.

The login and linking flow works perfectly in Chrome and IE, but the redirects result in a white page in Firefox. Strangely, there is no error whatsoever, as all code is executed and a simple F5 refresh of the page shows the correct page.

As you can see in the code below, I am only using a wp_redirect() once to trigger the authentication flow, which works and is not the problem. From there on it's Wordpress who handles all redirects and does so nicely in Chrome and IE but fails in Firefox

public function myplugin_callback() {
    global $wp_query;

    if ($wp_query->get('code')) {
        $_SESSION['code'] = $wp_query->get('code');
        $_SESSION['state'] = $wp_query->get('state');

        wp_redirect(site_url('wp-login.php', 'login'));
        echo 'Please wait, logging in.';
        exit;
    }
}

public function myplugin_authenticate($user, $username) {
    // do the authentication here
    if (isset($_SESSION['code'])) {
        /* get userdata via OAuth here */

        if (isset($userData['email'])) {
            $userSearch = get_user_by('email', $userData['email']);

            if ($userSearch) { // user exists
                $uuid = get_user_meta($userSearch->ID, 'myplugin_uuid', true);
                if ($uuid == $userData['uuid']) { // user is linked
                    $user = new WP_User($userSearch->ID);
                } else { // user is not linked
                    $_SESSION['myplugin-data'] = serialize($userData);
                    $user = new WP_Error('denied', __('You already have an account with this email on this blog. Please log in to link this account with our service.'));
                    remove_action('authenticate', 'wp_authenticate_username_password', 20);
                }
            } else { // user does not exist
                $user = new WP_Error();
            }
        }
        unset($_SESSION['code']);
    } else { // local login
        $userSearch = get_user_by('login', $username);

        if ($userSearch) {
            $uuid = get_user_meta($userSearch->ID, 'myplugin_uuid', true);

            if (!isset($_SESSION['myplugin-data']) && !empty($uuid) && !$this->myPluginHelper()->getlocalAuthAllowed()) {
                $user = new WP_Error('denied', __('Local login disabled. Please use myPlugin to log in.'), 'message');
                remove_action('authenticate', 'wp_authenticate_username_password', 20);
            } else {
                add_filter('login_redirect', array($this, 'save_myplugin_uuid'), 10, 3);
            }
        }
    }
    return $user;
}

public function save_myplugin_uuid($redirect_to, $request, $user) {
    if (isset($_SESSION['myplugin-data']) && is_a($user, 'WP_User')) {
        $userData = unserialize($_SESSION['myplugin-data']);
        update_usermeta($user->ID, 'myplugin_uuid', $userData['uuid']);
        unset($_SESSION['myplugin-data']);
    }
    return $redirect_to;
}

I have Googled quite a deal, to no avail. Does anyone have an idea?

Thanks Jeroen

Answer 1

Just like I thought (and had tested on Chrome and IE) the code is rock-solid.

This turned out to be an issue with our company's proxy.