| @@ -260,9 +260,9 @@ | ||
| 260 | 260 | |
| 261 | 261 | /** |
| 262 | 262 | * Where this site actually serves its protected-resource metadata. |
| 263 | 263 | * |
| 264 | - * Prefers the canonical /.well-known/…/xspeed/mcp URL, but many hosts own that prefix | |
| 264 | + * Prefers the canonical /.well-known/ URL, but many hosts own that prefix | |
| 265 | 265 | * for ACME/Let's Encrypt and answer it before WordPress runs — the client |
| 266 | 266 | * then follows a pointer to a 404 (or a redirect to the homepage) and the |
| 267 | 267 | * OAuth flow dead-ends. RFC 9728 allows a single resource_metadata value, |
| 268 | 268 | * so when the pretty path is not ours to serve we advertise the /wp-json |
| @@ -268,24 +268,9 @@ | ||
| 268 | 268 | * so when the pretty path is not ours to serve we advertise the /wp-json |
| 269 | 269 | * fallback, which no ACME tooling claims. |
| 270 | 270 | */ |
| 271 | 271 | private static function metadata_url(): string { |
| 272 | - // RFC 9728 §3.1: a resource whose identifier carries a path is | |
| 273 | - // discovered at the path-suffixed form. Always this one, never the | |
| 274 | - // root form — even on a site where root is still ours to serve. The | |
| 275 | - // challenge is what steers every re-discovery, so pointing it at the | |
| 276 | - // canonical identity is what eventually moves clients onto it; and | |
| 277 | - // its value must not depend on whether some other plugin happens to | |
| 278 | - // be installed, or a client that cached the header would find the | |
| 279 | - // URL under it change meaning. Root exists for clients that never | |
| 280 | - // read this header at all. (#266) | |
| 281 | - // | |
| 282 | - // Built off untrailingslashit() because get_home_url() concatenates | |
| 283 | - // the `home` option verbatim: with a trailing slash stored there, | |
| 284 | - // home_url( '/.well-known/…' ) returns a doubled slash and the URL | |
| 285 | - // 404s. | |
| 286 | - $pretty = untrailingslashit( home_url( '/' ) ) | |
| 287 | - . '/.well-known/oauth-protected-resource/' . Mcp_Pairing::SITE_ENDPOINT_PATH; | |
| 272 | + $pretty = home_url( '/.well-known/oauth-protected-resource' ); | |
| 288 | 273 | |
| 289 | 274 | /** |
| 290 | 275 | * Filter the advertised protected-resource metadata URL. |
| 291 | 276 | * |
| @@ -298,9 +283,9 @@ | ||
| 298 | 283 | |
| 299 | 284 | // Rewrites absent (plain permalinks, or a flush that never landed) |
| 300 | 285 | // means the pretty URL cannot resolve at all — use the fallback. |
| 301 | 286 | if ( ! McpModule::wellknown_rewrites_active() ) { |
| 302 | - return Mcp_Pairing::absolute( rest_url( McpModule::NS . '/mcp/.well-known/oauth-protected-resource' ) ); | |
| 287 | + return rest_url( McpModule::NS . '/mcp/.well-known/oauth-protected-resource' ); | |
| 303 | 288 | } |
| 304 | 289 | |
| 305 | 290 | return $pretty; |
| 306 | 291 | } |
