Hi @ecoshopn
I think the problem on your website is caused by a firewall ( probably ModSecurity ) that blocks requests when they contain certain strings, more specifically “.profile”:
With ModSecurity this is actually a very common problem, as they have this string on their black list, however one of the scopes that Google use:
also contains that “.profile” string, which means the OAuth requests of Google will be blocked.
You can easily check if this is you issue even without Nextend Social Login. You just need to open the /wp-login.php page with the .profile string appearing in a GET parameters value, e.g.:
- /wp-login.php?test=.profile
The request will be blocked and will return a 403 or 404 error. But if you make it no longer contain the blacklisted “.profile” string, e.g. you remove the last “e” character:
- /wp-login.php?test=.profil
that will load the /wp-login.php page just fine.
If this is your problem, you should get in touch with your host and ask them to disable the rule that causes the the 403/403. They have an error log that contains all kinds of error messages, including the ones triggered by the firewall. And that should contain the rule ID that causes this 403/404 error.
Once that rule is removed, the problem will no longer occur.
Or my other idea is that perhaps something (like a 3rd party) prevents us from finishing the OAuth communication. So if the previous test wouldn’t be any different for you, what I suggest is to configure our “OAuth redirect uri proxy page” and “Page for register flow” settings. Both of these can be found at our Global settings > General tab: https://nextendweb.com/nextend-social-login-docs/global-settings/
And you should configure them this way:
- For the Page for register flow: You should create a new page and add the shortcode into it: [nextend_social_login_register_flow] then select that page for this setting. Extra information before the registration with social login – like Terms and Conditions – would be asked on this page. ( Make sure you don’t use this page for anything else! )
- For the OAuth redirect uri proxy page: You should create another new and completely empty page ( that you won’t use for anything else either ) and select it as OAuth redirect uri proxy page. Once it is done, the redirect URL of each configured provider will change, as the OAuth flow will be handled over this new page instead of the /wp-login.php page ( or in your case “loginwp-chistudio-admin1234” ). So, you will need to add the new redirect URLs into each of your configured Apps again. ( Nextend Social Login will also warn you about this with that message that you saw earlier, and there you can see all the steps, but actually, you can find the redirect URLs in the Getting Started section of the providers, too. )
This way we will handle our codes over these 2 pages that you created, instead of the /wp-login.php. So the OAuth process should be able to finish.
