Warn before self-hosted sign-in over an insecure connection - #25870
Open
crazytonyli wants to merge 3 commits into
Open
Warn before self-hosted sign-in over an insecure connection#25870crazytonyli wants to merge 3 commits into
crazytonyli wants to merge 3 commits into
Conversation
Contributor
|
| App Name | WordPress | |
| Configuration | Release-Alpha | |
| Build Number | 34003 | |
| Version | PR #25870 | |
| Bundle ID | org.wordpress.alpha | |
| Commit | 6f65a56 | |
| Installation URL | 2eflm6fnm1df0 |
Contributor
|
| App Name | Jetpack | |
| Configuration | Release-Alpha | |
| Build Number | 34003 | |
| Version | PR #25870 | |
| Bundle ID | com.jetpack.alpha | |
| Commit | 6f65a56 | |
| Installation URL | 1vrhq63udrq8g |
crazytonyli
force-pushed
the
fix/xmlrpc-https-downgrade
branch
from
August 11, 2026 05:08
8cf3c89 to
edd751d
Compare
3 tasks
crazytonyli
force-pushed
the
task/selfhosted-http-signin-warning
branch
2 times, most recently
from
August 26, 2026 02:43
8b44c1b to
97e628f
Compare
crazytonyli
force-pushed
the
task/selfhosted-http-signin-warning
branch
from
August 26, 2026 06:48
97e628f to
1af1131
Compare
crazytonyli
marked this pull request as ready for review
August 26, 2026 06:48
Present a confirmation alert at the top of the authenticate choke point when any pre-authorization credential destination (the site URL, REST API root, or application-password authorization URL) uses non-loopback http. Cancel reuses the existing SignInError.cancelled, and the debug launch-argument path never reaches this gate. The alert is presented from the topmost controller because the sign-in entry points already present the SwiftUI login flow. When the pre-authorization flow was fully secure, coerce an unexpectedly-http callback site URL to https, and skip the sign-in-time XML-RPC options fetch if discovery resolves an insecure endpoint, so a site that proved secure end-to-end never has its credentials sent over an unencrypted connection.
ApplicationPasswordRepository must never transmit credentials to a non-loopback http destination on its own. Each path checks the destinations it contacts and throws insecureConnection for an insecure one: validation (the site URL and stored REST root) is checked in validatePasswords before any request, and self-hosted password creation (login_url, admin_url, and the wp-json base, all derived from xmlrpc and independently http-capable) is checked before creating. Jetpack sites create through the WordPress.com proxy over https and are not gated on the site's own scheme, so an https site with a valid token but a legacy http xmlrpc is not blocked. The REST API root resolved by discovery is validated before it is persisted to Blog.restApiRootURL, so an insecure value is never stored where other consumers could later send credentials to it. Getting an application password for an insecure site instead goes through the interactive sign-in flow, which shows the insecure-connection warning; existing repository callers already catch the error and degrade gracefully.
crazytonyli
force-pushed
the
task/selfhosted-http-signin-warning
branch
from
August 26, 2026 06:48
1af1131 to
6f65a56
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two main changes:
ApplicationPasswordRepository, which creates and validates application passwords, now only work with HTTPS url.