search

alixandru / q2a-open-login

Question2Answer Open Login plugin
62 stars 44 forks source link

q2a-open-login #67

Closed pau-minoves closed 8 years ago

pau-minoves commented 8 years ago

Hi,

I've found that q2a-open-login is not handling well hosting where both the domain.com and www.domain.com are available.

Accessing the page without www., If the callback is configured with www., clicking on a login provider will get you stuck in:

http://www.domain.com/?hauth.start=Twitter&hauth.time=1463602490

Displaying this text:

You cannot access this page directly.

If you manually go to the domain with www. it works normally. Apparently you can even be logged in with different accounts in every domain.

It is not uncommon to allow for both with and without www. urls. Could this be supported?

pau-minoves commented 8 years ago

Correction, in the example I provide it does not matter how the callback is configured. Apparently it adds the www. because the webpage is configured with that as site name.

alixandru commented 8 years ago

It is not possible to use both domain.com and www.domain.com with this plugin, due to multiple reasons (for example, some login providers require you to specify the URL of your site and if an auth request comes from a different URL - say without www in front - it will be rejected).

It is, therefore, advisable to choose one URL form (either with or without www) and stick with it - in your Q2A configuration and at web-server level (i.e. redirect to the chosen form when users enter the other URL in their browsers). This is also recommended for SEO purposes.