I am not really sure when the problem started but we have a long-standing and still very functional SSO script that was made in-house for automatic WP sign-in based on SSO handshake. The script is below.

After upgrading to WP 5.2 and looking at the health check and then narrowing down the issue I found that we are having both

Error: [] cURL error 28: Operation timed out after 10001 milliseconds with 0 bytes received


The loopback request to your site failed, this means features relying on them are not currently working as expected. Error: [] cURL error 28: Operation timed out after 10000 milliseconds with 0 bytes received

Both of these errors disappear when we take out the code snippet below. I just don't see where in the code it would effect REST/cURL type things. Let me know if there is anything else needed.

function safe_SSO() {
    global $wpdb;
    $wpprefix = $wpdb->prefix;
    $url = 'https://'.$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
    session_set_cookie_params(60 * 60 * 24 * 365);
    define('SAFE_APP_ID', get_option('AppID'));
    define('SAFE_KEY', get_option('AppKey'));
    $safeurl =  'https://EXAMPLE.com/login/sso/SSOService?app=' . SAFE_APP_ID;
    define('HOME', urlencode($url));
    define('SAFE_REDIRECT', $safeurl . "&returnurl=" . urlencode($url));

    if(is_user_logged_in()) {

             $current_user = wp_get_current_user();

    else if(!is_user_logged_in()) {
        // Start authentication and authorization
        if (!isset($_SESSION['USER_ID']) && !isset($_POST['digest'])) {
            // We've got no session and we've not returned from SAFE, so let's redirect to SAFE
            header('Location: ' . SAFE_REDIRECT);
        if (!isset($_SESSION['USER_ID']) && isset($_POST['digest'])) {
            // We've got no session but we've got a response from SAFE - let's check it
            $safe_uid = $_POST['uid'];
            $safe_name = $_POST['firstname'] . ' ' . $_POST['lastname'];
            $safe_time = $_POST['time'];
            $safe_email = $_POST['email'];
            $safe_digest = $_POST['digest'];
            $safe_returnurl = $_POST['returnurl'];
            // Calculate digest
            $safe_calchash = md5($safe_uid . $safe_time . SAFE_KEY);
            if ($safe_calchash !== $safe_digest) {
                die('SAFE authentication failed: digest not valid.');
            // Looks like we've got a legit user, set some session variables
            $_SESSION['USER_ID'] = $safe_uid;
            $_SESSION['fname'] = $_POST['firstname'];
            $_SESSION['lname'] = $_POST['lastname'];
            $_SESSION['USER_NAME'] = $safe_name;
            $_SESSION['USER_EMAIL'] = $safe_email;
        //If we've gotten to this point, the session is already valid, but we're not logged in to WP 
        //For added security, we should probably double check the digest here, but its not super critical
        $default = get_option('default_role'); //should be subscriber
        if (!username_exists($_SESSION['USER_ID'])){
                $random_password = wp_generate_password( $length=12, $include_standard_special_chars=false );
                $userdata = array(
                    'user_login'  =>  $_SESSION['USER_ID'],
                    'user_pass'   =>  $random_password,
                    'display_name' => $_SESSION['USER_NAME'],
                    'first_name' => $_SESSION['fname'],
                    'last_name' => $_SESSION['lname'],
                    'role' => $default,
                    'user_email' => $_SESSION['USER_EMAIL']
                $user_id = wp_insert_user( $userdata );
                wp_update_user( array ('ID' => $id, 'role' => $default ) ) ;
                echo "<meta http-equiv=\"refresh\" content=\"1\">";

        $user = get_user_by('login', $_SESSION['USER_ID'] );

        //If no capability is set, make them a subscriber
        $role = get_user_meta( $user->ID, $wpprefix . 'capabilities', true );
        if ( $role == '' || empty( $role ) ) {
            wp_update_user( array ('ID' => $id, 'role' => $default ) ) ;

        if (isset($_POST['returnurl']) && strlen($_POST['returnurl']) != 0) {
            //Now redirect to where we came from
            header('Location: ' . $_POST['returnurl']);
        } else { //Or just refresh the page so the cookie loads
            echo "<meta http-equiv=\"refresh\" content=\"1\">";
    } else {
        if (isset($_POST['returnurl']) && strlen($_POST['returnurl']) != 0) {
            //Now redirect to where we came from
            header('Location: ' . $_POST['returnurl']);

So if it helps and if the script is confusing it does this - checks to see if you are logged in - if so it passes you on to site, if not sends you to our SSO, when you come back if you have an existing account it sends you to the site, and if you do not have an existing account it grabs your user id from SSO and creates a new account for you and automatically logs you on. This script is still highly functioning other than the errors above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.