WP Engine Invalid Key

Hello Jeff,

No matter what I try I seem to continue to get the Invalid key error on the WP engine, but not on a local environment. I asked them to whitelist the custom TML URLS, but I’m still getting the same results. I’m running Buddypress and BBpress with a custom redirection script for all non-logged-in users.

If I remove the custom script, I still get the errors, but my redirect to the lost password page works with the invalid message. If I keep the redirect script, I get the invalid key, but never redirect to the lost password page.
(https://clubnetdev.wpengine.com/login/?redirect_to=https%3A%2F%2Fclubnetdev.wpengine.com%2Flostpassword%2F%3Ferror%3Dinvalidkey)

If I head straight to https://clubnetdev.wpengine.com/restpass I get redirect with the same issue as above.

If I remove TML, then the password reset works as intended.

If I run a test with TML on and no changes to scripts or anything on a local setup, everything works as intended.

I’m at the end of my rope, I’ve looked at everything I could. I’m hoping you have a nugget of information on WPengine that could help me figure out what server issues are causing this to fail.

Thanks!!

Custom redirect script:
// Lock site to logged in users.. Modified from wp-force-login plugin

function v_forcelogin() {

// Exceptions for AJAX, Cron, or WP-CLI requests
if ( ( defined( ‘DOING_AJAX’ ) && DOING_AJAX ) || ( defined( ‘DOING_CRON’ ) && DOING_CRON ) || ( defined( ‘WP_CLI’ ) && WP_CLI ) ) {
return;
}
$portfolioTemplate = get_template_directory() . ‘/page-portfolios.php’;
if (get_page_template() == $portfolioTemplate) {
return;
}

// Redirect unauthorized visitors

// Get visited URL
$schema = isset( $_SERVER[‘HTTPS’] ) && ‘on’ === $_SERVER[‘HTTPS’] ? ‘https://’ : ‘http://’;
$url = $schema . $_SERVER[‘HTTP_HOST’] . $_SERVER[‘REQUEST_URI’];

/**
* Bypass filters.
*
* @since 3.0.0 The $whitelist filter was added.
* @since 4.0.0 The $bypass filter was added.
* @since 5.2.0 The $url parameter was added.
*/
$bypass = apply_filters( ‘v_forcelogin_bypass’, false, $url );
$whitelist = apply_filters( ‘v_forcelogin_whitelist’, array(
‘https://clubnetdev.wpengine.com/lostpassword/’, ‘https://clubnetdev.wpengine.com/resetpass/’
) );

if ( preg_replace( ‘/\?.*/’, ”, $url ) !== preg_replace( ‘/\?.*/’, ”, wp_login_url() ) && ! $bypass && ! in_array( $url, $whitelist ) ) {
// Determine redirect URL
$redirect_url = apply_filters( ‘v_forcelogin_redirect’, $url );
if(strpos($redirect_url, ‘login’) !== false){
$redirect_url = get_site_url();
}
// Set the headers to prevent caching
nocache_headers();
// Redirect
wp_safe_redirect( wp_login_url( $redirect_url ), 302 );
exit;
}

} elseif ( function_exists( ‘is_multisite’ ) && is_multisite() ) {
// Only allow Multisite users access to their assigned sites
if ( ! is_user_member_of_blog() && ! current_user_can( ‘setup_network’ ) ) {
wp_die( __( “You’re not authorized to access this site.”, ‘wp-force-login’ ), get_option( ‘blogname’ ) . ‘ › ‘ . __( ‘Error’, ‘wp-force-login’ ) );
}
}
}
add_action( ‘template_redirect’, ‘v_forcelogin’, ‘my_forcelogin_bypass’, ‘v_forcelogin_bypass’ );

/**
* Restrict REST API for authorized users only
*
* @since 5.1.0
* @param WP_Error|null|bool $result WP_Error if authentication error, null if authentication
* method wasn’t used, true if authentication succeeded.
*
* @return WP_Error|null|bool
*/
function v_forcelogin_rest_access( $result ) {
if ( null === $result && ! is_user_logged_in() ) {
return new WP_Error( ‘rest_unauthorized’, __( ‘Only authenticated users can access the REST API.’, ‘wp-force-login’ ), array( ‘status’ => rest_authorization_required_code() ) );
}
return $result;
}
add_filter( ‘rest_authentication_errors’, ‘v_forcelogin_rest_access’, 99 );

/*
* Localization
*/
function v_forcelogin_load_textdomain() {
load_plugin_textdomain( ‘wp-force-login’, false, dirname( plugin_basename( __FILE__ ) ) . ‘/languages/’ );
}
add_action( ‘plugins_loaded’, ‘v_forcelogin_load_textdomain’ );`