[FIX] SSO.

Author: Seiger

functions/sso.php

@@ -32,7 +32,7 @@ function ms_b64u_json(array $a): string { return ms_b64u(json_encode($a, JSON_UN
  * Order of precedence:
  *  1) SMULTI_SSO_SECRET from environment (recommended: same across domains).
  *  2) If absent — read/write core/storage/ms_sso/secret.key (shared FS).
- *  3) Derive the final key by HMAC with SESSION_COOKIE_NAME as "info"/salt.
+ *  3) Normalize the final key to 32 raw bytes (SHA-256).
  *
  * @return string Raw bytes (string) to be used as HMAC key.
  */
@@ -42,6 +42,9 @@ function ms_sso_secret(): string {
         if ($sec) return $sec;
 
         $base = getenv('SMULTI_SSO_SECRET');
+        if ((!$base || $base === '') && function_exists('env')) {
+            $base = env('SMULTI_SSO_SECRET');
+        }
         if (!$base || strlen($base) < 32) {
             $dir  = rtrim(EVO_CORE_PATH ?? __DIR__, '/') . '/storage/ms_sso';
             $file = $dir . '/secret.key';
@@ -54,10 +57,10 @@ function ms_sso_secret(): string {
             }
         }
 
-        $cookieName = defined('SESSION_COOKIE_NAME') ? SESSION_COOKIE_NAME : session_name();
-        // HKDF-like derivation: bind to cookie name (makes cross-install reuse safer).
-        $derived = hash_hmac('sha256', $cookieName, $base, true);
-        return $sec = $derived;
+        // Important: do not bind the signing key to SESSION_COOKIE_NAME.
+        // In multi-domain setups cookie names often differ between domains,
+        // which would make SSO tokens unverifiable and produce "Invalid/expired".
+        return $sec = hash('sha256', (string)$base, true);
     }
 }
 
@@ -86,16 +89,17 @@ function ms_sso_token_make(array $claims, int $ttl = 180): string {
  * @return array|null Payload if valid; null otherwise
  */
 if (!function_exists('ms_sso_token_parse')) {
-    function ms_sso_token_parse(string $jwt): ?array {
-        if (!preg_match('~^[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+$~', $jwt)) return null;
+    function ms_sso_token_parse(string $jwt, ?string &$err = null): ?array {
+        $err = null;
+        if (!preg_match('~^[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+$~', $jwt)) { $err = 'format'; return null; }
         [$h, $p, $s] = explode('.', $jwt, 3);
         $calc = ms_b64u(hash_hmac('sha256', "$h.$p", ms_sso_secret(), true));
-        if (!hash_equals($calc, $s)) return null;
+        if (!hash_equals($calc, $s)) { $err = 'signature'; return null; }
         $payload = json_decode(base64_decode(strtr($p, '-_', '+/')), true);
-        if (!$payload || !is_array($payload)) return null;
+        if (!$payload || !is_array($payload)) { $err = 'payload'; return null; }
         $now = time();
-        if (isset($payload['nbf']) && $payload['nbf'] > $now) return null;
-        if (isset($payload['exp']) && $payload['exp'] < $now) return null;
+        if (isset($payload['nbf']) && $payload['nbf'] > $now) { $err = 'nbf'; return null; }
+        if (isset($payload['exp']) && $payload['exp'] < $now) { $err = 'exp'; return null; }
         return $payload;
     }
 }

plugins/sMultisitePlugin.php

@@ -332,7 +332,7 @@ function ms_sso_load_functions(): void {
     $scheme = $https ? 'https' : 'http';
     $slow   = isset($_GET['slow']);
     $cookie = defined('SESSION_COOKIE_NAME') ? SESSION_COOKIE_NAME : session_name();
-    $rootDom = getenv('MS_SESSION_ROOT_DOMAIN') ?: '';
+    $rootDom = getenv('MS_SESSION_ROOT_DOMAIN') ?: (function_exists('env') ? (string)env('MS_SESSION_ROOT_DOMAIN', '') : '');
 
     $noStore = static function () {
         header('Cache-Control: no-store, no-cache, must-revalidate');
@@ -447,8 +447,10 @@ function ms_sso_load_functions(): void {
         $code   = (string)($_GET['c'] ?? '');
         $return = (string)($_GET['return'] ?? '/');
 
-        $data = ms_sso_token_parse($code);
+        $err = null;
+        $data = ms_sso_token_parse($code, $err);
         if (!$data || ($data['mode'] ?? '') !== 'login' || empty($data['sid'])) {
+            error_log('[sMultisite SSO] RECEIVER login invalid token err=' . ($err ?? 'unknown') . ' host=' . ($_SERVER['HTTP_HOST'] ?? '') . ' sfm=' . ($_SERVER['HTTP_SEC_FETCH_MODE'] ?? ''));
             header('HTTP/1.1 400 Bad Request'); echo 'Invalid/expired'; exit;
         }
 
@@ -477,8 +479,10 @@ function ms_sso_load_functions(): void {
         $code   = (string)($_GET['c'] ?? '');
         $return = (string)($_GET['return'] ?? '/');
 
-        $data = ms_sso_token_parse($code);
+        $err = null;
+        $data = ms_sso_token_parse($code, $err);
         if (!$data || ($data['mode'] ?? '') !== 'logout') {
+            error_log('[sMultisite SSO] RECEIVER logout invalid token err=' . ($err ?? 'unknown') . ' host=' . ($_SERVER['HTTP_HOST'] ?? '') . ' sfm=' . ($_SERVER['HTTP_SEC_FETCH_MODE'] ?? ''));
             header('HTTP/1.1 400 Bad Request'); echo 'Invalid/expired'; exit;
         }