Referrer-Policy None breaks password protected pages

  • Resolved solex

    (@solex)


    3 years, 6 months ago

    When you have a page in WordPress which has visibility set as “password protected”, having the Referrer-Policy option in apocalypse meow set to NONE prevents the page from loading when a user inputs a correct password. I thought it could be useful for you to either place this information in the tool-tip or even better fix the behaviour so it loads the page.

    Info:
    WordPress 5.7.2
    apocalypse meow version 21.7.2

    Password tech (wordpress built-in)

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Blobfolio

    (@blobfolio)

    Thanks @solex! I’ll take a look and see what weirdness WP is doing. Haha.

    Would you mind letting me know what theme your site is using?

    Plugin Author Blobfolio

    (@blobfolio)

    Never mind about the theme, @solex. The problem is with the WP Core.

    The post-password form doesn’t contain any information about the post being visited; it’s just the password field. The generic wp-login.php endpoint handling those requests just blindly shoves a hash of the typed password into a cookie, then tries to work backwards to figure out where the user came from by checking the referral header. (This is the bit that None is breaking for you.)

    It’s a very curious design.

    Unfortunately this isn’t something Apocalypse Meow can really fix, but I did push a small update, adding information about the possible incompatibility to the referrer-policy info box.

    If you have the option to mark your posts “private” rather than “password protected”, I would recommend doing that instead. WordPress’ password protection feature is sketchy. Form weirdness aside, post passwords are stored in plain text in the database and the posts themselves are marked “publish” just like public posts, making it really easy for a theme or plugin to accidentally leak their content.

    • This reply was modified 3 years, 6 months ago by Blobfolio. Reason: Clarify sentence subject
    • This reply was modified 3 years, 6 months ago by Blobfolio.
    Thread Starter solex

    (@solex)

    Great – thanks for the quick response and the feedback ??

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Referrer-Policy None breaks password protected pages’ is closed to new replies.