Require re-login when logged-in user attempts to access restricted page

Question

I need to restrict access to certain frontend pages, based on a user_meta field.

All works fine, except when the user is already logged in but with the wrong credentials. In that situation I would want them to be redirected to the login form (with a message encouraging them to logout and login again with suitable credentials - I can do that bit).

Instead, the user ends up with the "redirecting in a way that will never complete" message.

I think the only bit of my code that's relevant to this issue is:

if(!$user_is_approved) {
    wp_redirect(wp_login_url( get_permalink() ));
    exit;
}

What's the best way of achieving this?

Answer 1

When you say that the user is "logged in but with the wrong credentials" I have to assume you mean "the user is logged in with correct credentials but does not have the permissions needed to access the page". If users were able to log in with the wrong credentials you site would be badly broken.

That redirect, all by itself, won't cause the error you describe. You can prove that by pasting the following into your theme's header.php:

wp_redirect(wp_login_url( get_permalink() ));
exit;

Any attempt to get to a front end page will redirect but there is no infinite redirect loop. The problem must be where you have placed that code and you don't include that information. I expect you have it somewhere-- a hook maybe-- that loads for the login page as well so that when the redirect gets started it never stops (until the browser gives up). Sorting that out will probably solve the issue at hand.

I have to wonder why you are using a user meta field instead of a capability, though. I don't see why the built in permissions system can't handle this.

Answer 2

Thanks to @s_ha_dum I eventually tracked the issue down to the following line in my wp-config.php file...

@define('ADMIN_COOKIE_PATH', '/');

Commenting this out solved the problem

Ironically, I've tended to include this line as a standard preventative measure against login redirection loops. (Can't remember where I first got this from, but there's some lively debate on the topic here.) I suppose this illustrates the dangers of using magic incantations without really understanding what they're doing..