| @@ -260,9 +260,9 @@ | ||
| 260 | 260 | |
| 261 | 261 | /** |
| 262 | 262 | * Where this site actually serves its protected-resource metadata. |
| 263 | 263 | * |
| 264 | - * Prefers the canonical /.well-known/ URL, but many hosts own that prefix | |
| 264 | + * Prefers the canonical /.well-known/…/xspeed/mcp URL, but many hosts own that prefix | |
| 265 | 265 | * for ACME/Let's Encrypt and answer it before WordPress runs — the client |
| 266 | 266 | * then follows a pointer to a 404 (or a redirect to the homepage) and the |
| 267 | 267 | * OAuth flow dead-ends. RFC 9728 allows a single resource_metadata value, |
| 268 | 268 | * so when the pretty path is not ours to serve we advertise the /wp-json |
| @@ -268,9 +268,24 @@ | ||
| 268 | 268 | * so when the pretty path is not ours to serve we advertise the /wp-json |
| 269 | 269 | * fallback, which no ACME tooling claims. |
| 270 | 270 | */ |
| 271 | 271 | private static function metadata_url(): string { |
| 272 | - $pretty = home_url( '/.well-known/oauth-protected-resource' ); | |
| 272 | + // RFC 9728 §3.1: a resource whose identifier carries a path is | |
| 273 | + // discovered at the path-suffixed form. Always this one, never the | |
| 274 | + // root form — even on a site where root is still ours to serve. The | |
| 275 | + // challenge is what steers every re-discovery, so pointing it at the | |
| 276 | + // canonical identity is what eventually moves clients onto it; and | |
| 277 | + // its value must not depend on whether some other plugin happens to | |
| 278 | + // be installed, or a client that cached the header would find the | |
| 279 | + // URL under it change meaning. Root exists for clients that never | |
| 280 | + // read this header at all. (#266) | |
| 281 | + // | |
| 282 | + // Built off untrailingslashit() because get_home_url() concatenates | |
| 283 | + // the `home` option verbatim: with a trailing slash stored there, | |
| 284 | + // home_url( '/.well-known/…' ) returns a doubled slash and the URL | |
| 285 | + // 404s. | |
| 286 | + $pretty = untrailingslashit( home_url( '/' ) ) | |
| 287 | + . '/.well-known/oauth-protected-resource/' . Mcp_Pairing::SITE_ENDPOINT_PATH; | |
| 273 | 288 | |
| 274 | 289 | /** |
| 275 | 290 | * Filter the advertised protected-resource metadata URL. |
| 276 | 291 | * |
| @@ -283,9 +298,9 @@ | ||
| 283 | 298 | |
| 284 | 299 | // Rewrites absent (plain permalinks, or a flush that never landed) |
| 285 | 300 | // means the pretty URL cannot resolve at all — use the fallback. |
| 286 | 301 | if ( ! McpModule::wellknown_rewrites_active() ) { |
| 287 | - return rest_url( McpModule::NS . '/mcp/.well-known/oauth-protected-resource' ); | |
| 302 | + return Mcp_Pairing::absolute( rest_url( McpModule::NS . '/mcp/.well-known/oauth-protected-resource' ) ); | |
| 288 | 303 | } |
| 289 | 304 | |
| 290 | 305 | return $pretty; |
| 291 | 306 | } |
