I use Google Apps SSO to authenticate my users for all my WordPress sites. In the authentication process google returns few parameters to the given url and one of the parameters is scope which consists of https://www.googleapis.com/auth/userinfo.profile scope.

By default wordpress relies on apache for SEO friendly url's/permalinks. Now when google redirects me to https://example.com/wp-login.php?state=###&code=###&scope=https://www.googleapis.com/auth/userinfo.profile+https://www.googleapis.com/auth/plus.me+https://www.googleapis.com/auth/userinfo.email server(apache) is giving me a 404 error. After some trial and error I found out if I remove the .profile from the url or just remove . (dot) redirection/behaviour happens as expected.

I'm not a apache expert so I want understand this behavior and how can I resolve this in global scope.

--- Edit ---

.htaccess file in the local scope

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

From my understanding if a file/directory specified in the url doesn't exist then the request is handed over to the WordPress index.php for processing.

@MrWhite: To answer your question, from the URL I mentioned above wp-login.php file exists but still apache passes down the request to index.php WordPress which return 404 error.

Using filters if I change the url from example.com/wp-login.php to example.com/login I get 403 error.

But if I remove . (dot) in the url before profile keyword everything works as expected.

-- edit 2 --

I found out this is happening because of mod_security rule to restrict access to OS files. https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/c06e2f5f7efa1c24f18ddf9a3298e3db4cdfeaac/rules/restricted-files.data#L34 I understand this is a necessary rule but how do make mod_security allow https://www.googleapis.com/auth/userinfo.profile in the URL args (just this URL)?

  • Just to confirm, you are seeing an Apache generated 404 response, not a WordPress 404? You’ve tagged your question with both Apache-2.2 and Apache-2.4? If it really is an Apache issue, then maybe there is a modSecurity rule set to deny such URLs? Although you wouldn’t expect a 404 in that case, possibly a 403 or 406?
    – MrWhite
    Sep 25, 2018 at 19:17
  • I'm getting WordPress 404
    – Manoj H L
    Sep 25, 2018 at 19:19
  • In that case, this perhaps looks more like a WordPress issue rather than an Apache issue?
    – MrWhite
    Sep 25, 2018 at 19:22
  • @MrWhite I'm also not sure whether this is Apache or WordPress issue. To clarify I changed the login URL to example.com/login and now I get 403 forbidden error
    – Manoj H L
    Sep 25, 2018 at 19:23
  • From my understanding, WordPress use Apache mod_rewrite for pretty permalinks and then tries which entry fits into this. Also WP make sure of a file or directory exists then the file is served and not the wp page.
    – Manoj H L
    Sep 25, 2018 at 19:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy