Custom login form redirect to external site

Question

I created a private page, but this page needs to be more than just available by entering a code for a page that has been listed private in the Publish settings of Visibility, so I created a page and have added an if/else statement to check if the user is logged in or not. If so, the content displays as it should, if they aren't the login form appears and the user is prompted to login which appears as it should.

The problem is, after they login using the form they are redirected to the admin page. I have added a redirect to the login page to go to the page I want but it doesn't seem to work. Am I doing the redirect incorrectly?

<?php
/*
Template Name: Minutes
*/
?>

<?php get_header(); ?>

<?php get_template_part( 'templates/content', 'nav' ); ?>  
<?php get_template_part( 'templates/content', 'breadcrumb' ); ?> 




<section class="band bottom u-full-width" style="margin-top: 2%">
    <div class="container">
        <div class="row">


<?php if (is_user_logged_in()) { ?>


<div class="ten columns" >

<h5><b>Click the Plus (+) Sign to expend the list of available minutes per section</b></h5>   

Plus more code


<?php } else {
    echo 'We are sorry, but this area is only for registered, logged in users. If you are a registered user, please use the link below to login to the site to view content not available to the general public.  If you have any questions, please contact us.';
    wp_login_form(array('redirect' => 'http://etomv2.bambergmarketing.com/meeting-minutes'));
}
?>

</div>

</div></div>
</section>

<?php get_footer(); ?>

Answer 1

Internal happenings explained

When you look at wp_login_form(), then you will see, that the redirect argument will ask for an absolute URl. So either use admin_url() or site_url() if you want to link internally.

The action/ target of this form is not meant to be changed (unless you set echo to FALSE and use some \DOMDocument replacement or some Regex to change it in the output string):

action="' . esc_url( site_url( 'wp-login.php', 'login_post' ) ) . '" method="post"

When you then look at wp_login.php and the case : 'login'|default, you will note two things:

1. There's a filter to adjust the redirect, which might override anything set in your arguments. Keep in mind that this might even switch depending on the user who performs the login action (typically used to redirect users of different roles to different welcome screens):

   apply_filters( 'login_redirect', $redirect_to, $requested_redirect_to, $user );
   

2. Then the user gets checked if it is authenticated and not an erroneous object. Depending on that, if the request is not directed at the /wp-admin side of things, the following function is called:

   exit( wp_safe_redirect( $target ) );
   

…and using wp_safe_redirect() means that you can not link outside (figured that from @TheDeadMedic comment – thanks!).

Solutions

As usual in WordPress, you have options:

1. This function is inside pluggable.php, which means you can replace it with your own function. This is not very stable (every other plugin can do the same), but it's ok if you use it on your personal site, document this is in place and fix things when there's a conflict. More info in this question and the answer by @ChipBennet on it.

2. The better solution is to look at wp_validate_redirect() which is internally used by wp_safe_redirect() and leverage the filter that WP offers to extend the list of allowed hosts.

   // End of `wp_validate_redirect()`
   $allowed_hosts = (array) apply_filters( 
       'allowed_redirect_hosts', 
       array( $wpp['host'] ), 
       isset( $lp['host'] ) ? $lp['host'] : '' 
   );
   
   if ( 
       isset($lp['host']) 
       && ( !in_array($lp['host'], $allowed_hosts) 
       && $lp['host'] != strtolower($wpp['host'])) 
   )
       $location = $default;
   

   In your case a (mu-)plugin to allow that redirect would look like the following:

   <?php /* Plugin Name: Allow external login redirect */
   add_filter( 'allowed_redirect_hosts', function( Array $hosts, $check )
   {
       return $hosts + [ 'http://etomv2.bambergmarketing.com' ];
   }, 10, 2 );
   

   Also take a look at the second argument inside wp_safe_redirect( $target, $fallback ) that is used for wp_validate_redirect(). It is set as filter. That means, that you can redirect to another external URl in case your login fails. Or you can redirect locally to some error page (or just the current page, which is the default):

   apply_filters( 'wp_safe_redirect_fallback', admin_url(), $status )
   

The second solution is what I would use. You might also want to use it in case you are using some external OAuth provider that you need to validate users against.

Note

In case you read the docs and wonder about login_post as "scheme" in there: The site_url() function is a wrapper for get_site_url() which uses set_url_scheme() internally. There login_post, login and rpc are equal to admin, which adjusts the action properly:

$scheme = is_ssl() || force_ssl_admin() ? 'https' : 'http';