why is $_REQUESt['redirect_to'] empty?

Question

wp-login.php uses $_REQUEST['redirect_to'] as a way to override redirection for lostpassword link. However, it doesn't seem to work for some reason. Maybe its my server environment, but $_REQUEST['redirect_to'] value is unset even if I explicitly pass it as a GET variable in the URI.

Is this a wordpress thing or something possibly with my hosting environment or just me being a newb?

I saw another post where user @rarst mentioned WP implements its own logic behavior to enforce REQUEST as a combo of GET and POST. But I don't see the code he's talking about anywhere in wp-login and not in wp-load, either. So I'm guessing that REQUEST on wp-login behaves however the php environment is configured for it to behave.

Anyone have some insight on this?

Answer 1

The redirect_to variable works fine, even as a GET variable, however wp-login.php also uses wp_safe_redirect() for doing the actual redirection, which means that the URL must be on the same website. You can't redirect to anywhere in the web, just to the same site as the login is located on. This is to prevent some sorts of XSS issues.