App Passwords: allow http success and reject URLs with local environment type.

[peterwilsoncc]

wp_is_authorize_application_password_request_valid() prevents an authorization request if either the success or reject URLs are over insecure connections (http).

On systems with the environment type set to local it would be helpful if these checks were bypassed in line with other aspects of the app passwords component.

[TimothyBlynJacobs]

Relevant ​Slack discussion.

[wppunk]

Leave it with me. I'm going to fix it.

I've update the wp_is_authorize_application_password_request_valid function and allow to use unsecure connection for the local environment.

Trac ticket: https://core.trac.wordpress.org/ticket/52617

[cadic]

I've tested this patch and it works.

With the local environment, it's now possible to authorize an application where a Success URL, Rejection URL or both are server over an insecure connection.

With other environments, the usual "The Authorize Application request is not allowed." error is displayed.

[JeffPaul]

@peterwilsoncc probably too late for 6.1, but we could milestone to 6.2 and mark for commit as well perhaps?

[peterwilsoncc]

probably too late for 6.1, but we could milestone to 6.2 and mark for commit as well perhaps?

Works for me.

[viralsampat]

Hello @peterwilsoncc I have checked this patch and its works for me as well. Here, I have added comment for condition.

https://core.trac.wordpress.org/ticket/52617

G'day Max,

Closing this in favour of PR ​https://github.com/WordPress/wordpress-develop/pull/3912 as the repo structure has changed a bit and I didn't want to push to your branch.

You'll still get props though.

[peterwilsoncc]

I've refreshed the original PR against trunk and it all seems to work via manual testing.

Prior to commit, I'll add some tests to ensure the insecure values are permitted for local environments.

[peterwilsoncc]

Extended the unit tests to include the environment in the ​linked pull request.

if someone else can sign off of the tests, I think this is good for commit.

Props @costdev for rubber ducking the tests with me.

[costdev]

@mukesh27 has reviewed and approved ​PR 3912. I think this is ready for commit consideration now.

[johnbillion]

In 55283:

Application Passwords: Allow plain HTTP success and reject URLs when using a local environment type.

It's not uncommon for local environments to run over HTTP due to the relative complexity of configuring HTTPS for a local environment. This change allows HTTP URLs for application password responses when that is the case.

Props peterwilsoncc, wppunk, cadic, viralsampat

Fixes #52617

https://core.trac.wordpress.org/changeset/55283