Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page
The problem I am facing is the fact the subdomain is on a different server so I am unable to include/require the
Is there a way that I can whitelist domains that can allow instant logouts, like you can for the redirect whitelist.
If not, how can I allow subdomains (it has remote sql access) to create a valid logout link that bypasses the "Are you sure you want to logout" notice.
Does this like a logical work around to make sure the logout is "valid" to a certain degree:
- Set the logout URL every 24 hours to have a query string with a random string appended to it for example:
http://website.com/custom_logout.php?confirm=sj239ks, followed by
Each time it changes it would edit a specific file (custom_logout.php on the other server OR a txt/ini file on its own server OR other server) and create an array/list of strings
$confirmkeys = array("sj239ks", "32k9la3");
[confirmkeys] confirm = sj239ks confirm = 32k9la3
It would only ever have 2 confirm keys in the file, one for 24 hours ago (just incase someone has the page still open) and one for the current 24 hours)
I guess the same thing could be done individually instead of globally but is there much need for that?
custom_logout.phpto add a check to see if
$_SERVER['HTTP_REFERER']is coming from the same domain (all subdomains). If it is then set
matching_refererto true. If not set the variable to false.
custom_logout.phpto add a check to see if the query string matches against one stored inside a specific file. (easiest to do with a txt/ini file on the secondary server?) If it matches then set
matching_confirmto true. If not set the variable to false.
custom_logout.phpand make it so as long if one (any) of the checks are true for it to logout cleanly, if they are both false logout with the warning by sending them to the