fix: 1.0.1 — domain verification fails on default permalink settings - #7
Merged
Conversation
… URL WordPress's default redirect_canonical() 301s /.well-known/tetapi-verify.txt to add a trailing slash (it doesn't recognize the rewrite endpoint as a real page). The API's domain verifier deliberately does not follow redirects (SSRF hardening — a caller-controlled domain must not be able to redirect the check elsewhere), so it only ever saw the empty 301 body and never found the token, leaving verification stuck on "Pending" forever even with a correct token in place. Root-caused via a live WordPress site (lastivka.it-ua.org) whose "Check now" kept failing: confirmed the redis token and the served file byte matched exactly, then found the prod API code (which had grown SSRF hardening — follow_redirects=False + private-IP guard — since this plugin was first written) reproduces the failure only through the redirect, not directly. Fix: skip WordPress's canonical redirect specifically for this one rewrite endpoint via `redirect_canonical`. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
Domain ownership verification (well-known file method) could get stuck
on "Pending" forever, even with the correct token in place, on a live
site (lastivka.it-ua.org).
Root cause
redirect_canonical()301s/.well-known/tetapi-verify.txtto add a trailing slash (doesn't recognize the rewrite endpoint).
follow_redirects=False(SSRFhardening added after this plugin shipped) — so it only ever sees the
redirect's empty body, never the token.
(byte-identical), and reproducing the exact
httpxcall from prod —it only fails through the real redirect chain.
Fix
Skip WordPress's canonical redirect for this one rewrite endpoint.
Bumped to 1.0.1, changelog + upgrade notice added.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com