fix(sso): scope redirect loop counter to SSO hops

inc/sso/class-sso.php

@@ -438,7 +438,7 @@ private function should_skip_redirect_due_to_loop(): bool {
 		$threshold = (int) apply_filters('wu_sso_redirect_loop_threshold', 3);
 		$window    = (int) apply_filters('wu_sso_redirect_loop_window', 120);
 
-		if ($threshold < 1 || $window < 1) {
+		if ($threshold < 1 || $window < 1 || ! $this->is_sso_loop_request()) {
 			return false;
 		}
 
@@ -466,6 +466,34 @@ private function should_skip_redirect_due_to_loop(): bool {
 		return $count >= $threshold;
 	}
 
+	/**
+	 * Check if the current request looks like an SSO loop hop.
+	 *
+	 * Plain logged-out visits to protected URLs can call auth_redirect()
+	 * repeatedly without ever entering the SSO flow. Only requests carrying an
+	 * SSO fingerprint should consume the redirect-loop budget.
+	 *
+	 * @since 2.0.11
+	 * @return bool True when the request carries an SSO fingerprint.
+	 */
+	private function is_sso_loop_request(): bool {
+
+		if ($this->input('wu_sso_token') || 'login' === $this->input('sso') || $this->input('return_url') || $this->input('_jsonp')) {
+			return true;
+		}
+
+		$referer = wp_get_referer();
+
+		if ( ! $referer) {
+			return false;
+		}
+
+		$referer_path = (string) wp_parse_url($referer, PHP_URL_PATH);
+		$sso_path     = '/' . ltrim($this->get_url_path(), '/');
+
+		return 0 === strpos($referer_path, $sso_path);
+	}
+
 	/**
 	 * Listens for SSO requests and route them to the correct handler.
 	 *

tests/WP_Ultimo/SSO/SSO_Test.php

@@ -45,10 +45,13 @@
 		unset($_REQUEST['broker']);
 		unset($_REQUEST['sso_verify']);
 		unset($_REQUEST['wu_sso_token']);
+		unset($_REQUEST['sso']);
 		unset($_REQUEST['return_url']);
 		unset($_REQUEST['redirect_to']);
+		unset($_REQUEST['_jsonp']);
 		unset($_COOKIE['wu_sso_denied']);
 		unset($_COOKIE['wu_sso_redirect_attempts']);
+		unset($_SERVER['HTTP_REFERER']);
 
 		remove_all_filters('wu_sso_redirect_loop_threshold');
 		remove_all_filters('wu_sso_redirect_loop_window');
@@ -253,6 +256,8 @@
 	public function test_sso_redirect_loop_counter_skips_at_threshold(): void {
 		$sso = SSO::get_instance();
 
+		$_REQUEST['sso'] = 'login';
+
 		add_filter(
 			'wu_sso_redirect_loop_threshold',
 			function () {
@@ -276,6 +281,8 @@
 	public function test_sso_redirect_loop_counter_resets_after_window(): void {
 		$sso = SSO::get_instance();
 
+		$_REQUEST['sso'] = 'login';
+
 		add_filter(
 			'wu_sso_redirect_loop_threshold',
 			function () {
@@ -299,6 +306,34 @@
 		$this->assertSame(1, $this->get_sso_redirect_attempt_count());
 	}
 
+	/**
+	 * Test plain protected URL visits do not consume the SSO loop budget.
+	 */
+	public function test_sso_redirect_loop_counter_ignores_non_sso_requests(): void {
+		$sso = SSO::get_instance();
+
+		$method = new \ReflectionMethod($sso, 'should_skip_redirect_due_to_loop');
+		$method->setAccessible(true);
+
+		$this->assertFalse($method->invoke($sso));
+		$this->assertSame(0, $this->get_sso_redirect_attempt_count());
+	}
+
+	/**
+	 * Test SSO referers consume the redirect-loop budget.
+	 */
+	public function test_sso_redirect_loop_counter_counts_sso_referer(): void {
+		$sso = SSO::get_instance();
+
+		$_SERVER['HTTP_REFERER'] = home_url('/sso');
+
+		$method = new \ReflectionMethod($sso, 'should_skip_redirect_due_to_loop');
+		$method->setAccessible(true);
+
+		$this->assertFalse($method->invoke($sso));
+		$this->assertSame(1, $this->get_sso_redirect_attempt_count());
+	}
+
 	/**
 	 * Get the redirect-attempt count from the test cookie.
 	 *
@@ -640,7 +675,7 @@
 	 * when sso_verify is 'invalid', preventing redirect loops.
 	 */
 	public function test_handle_broker_source_sets_denied_cookie_on_invalid_verify(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -658,7 +693,7 @@
 	 * so that later code (handle_auth_redirect, enqueue_script) sees it immediately.
 	 */
 	public function test_handle_broker_source_sets_cookie_superglobal_on_invalid_verify(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -675,7 +710,7 @@
 	 * instead of leaving the user on the /sso 404 page.
 	 */
 	public function test_handle_broker_source_redirects_to_return_url_on_invalid_verify(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -698,7 +733,7 @@
 	 * causes an infinite redirect loop.
 	 */
 	public function test_handle_broker_source_returns_jsonp_error_for_unattached_broker(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -717,7 +752,7 @@
 	 * redirect -> sso_verify=invalid -> redirect -> repeat.
 	 */
 	public function test_sso_js_does_not_contain_incognito_redirect(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/assets/js/sso.js'
 		);
 
@@ -749,7 +784,7 @@
 	 * Test handle_requests normalizes sso-grant URLs before dispatching.
 	 */
 	public function test_handle_requests_source_normalizes_sso_grant_to_server_action(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -903,7 +938,7 @@
 	 * call before the printf to guard against regressions.
 	 */
 	public function test_handle_server_source_sets_javascript_content_type_for_jsonp(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);
 
@@ -927,7 +962,7 @@
 	 * 4. handle_main_site_logged_in_user JSONP success response
 	 */
 	public function test_handle_broker_source_sets_javascript_content_type_for_jsonp(): void {
 		$source = file_get_contents(
 			dirname(__DIR__, 3) . '/inc/sso/class-sso.php'
 		);