WordPress's native redirect_to login parameter not followed after login #962

Checklist

• I have looked into the Readme and the documentation, and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

redirect_to is a standard WordPress convention. wp_login_form(), wp_loginout(), and core's own wp-login.php all use it to send a user back to whatever page they were trying to reach before being prompted to authenticate. v4 of this plugin supported it as a first-class, documented feature but for whatever reason, this support is missing in v5.

Reproduction

1. As a logged-out user (or with an expired session), visit any deep admin URL requiring login, e.g. wp-admin/edit.php?post_type=page.
2. Complete login via Auth0.
3. Observe you land on the dashboard/site root instead of back on the page list you were trying to reach.

Additional context

v4 implementation for reference: request parsing in WP_Auth0_LoginManager.php:71-73, threaded through state in WP_Auth0_Lock.php:34-37 and get_authorize_params() (~461-503), honored on callback at WP_Auth0_LoginManager.php:237-238, documented in readme.txt:64.
Suggested fix: capture $_REQUEST['redirect_to'], thread through the state param sent to Auth0, validate with wp_validate_redirect() on return, use as the final destination.

wp-auth0 version

5.6.1

WordPress version

7.1

PHP version

8.4