Reset my Password, now I can't login to Gravatar

gattyme · Member · Apr 10, 2017 at 5:35 am
Copy link

Add topic to favorites
I reset my password (account hygiene), and now when I go to sign in the redirect leaves me signed out with the message ‘Gravatar now allows you to use a WordPress.com account to sign in. If you have a WordPress.com account already then you can use that, or you can create a new one.’

I can login to wordpress.com, but gravatar.com is sadpanda.

Halp, I need an adult!

The blog I need help with is: (visible only to logged in users)
dave2swords · Member · Apr 10, 2017 at 6:50 am
Copy link
Hi there!
Since you have a Gravatar question, you might have better luck on the Gravatar help page!

Good luck!
dave
chinburg · Member · Apr 10, 2017 at 9:15 am
Copy link
I have the same login-loop problem, also encountered after changing my password.

From the Gravatar help page, you are redirected to this forum in order to find a solution.

Anyone have other ideas?
coachlisanne · Member · Apr 10, 2017 at 3:18 pm
Copy link
Same loop. :-( Was directed here from Gravatar for help.
coachlisanne · Member · Apr 10, 2017 at 3:19 pm
Copy link
Same loop. :-( Was directed here from Gravatar for help.
dave2swords · Member · Apr 10, 2017 at 4:07 pm
Copy link
Ok everybody
You all changed your WordPress password and can’t connect to your Gravatar profiles. Let’s try disconnecting and reconnecting.

Go to https://wordpress.com/me/security/connected-applications
Find Gravatar
Click Disconnect on the right
Count to thirty seven by threes (or at least get as close as you can) or not
Click Connect
See if that worked

Let us know if that worked
dave
gattyme · Member · Apr 10, 2017 at 9:13 pm
Copy link
Here’s what I did: absolutely nothing.

I want to bed, and tried again this morning and it’s come right. Logging out and in again through the gravatar site has everything working.

For science I went and reset my password again and broke it. My hope is that I can solve this for other people, there’s something stuffed up the SSO.

This is a systems problem and should be raised with the WP team.

Reproduction steps:

1. Login to wordpress.com
2. Reset your password
3. Logout of wordpress.com
4. Go to gravatar.com, try login using your credentials

What happens?
You get redirected back presented with the message “Gravatar now allows you to use a WordPress.com account to sign in. If you have a WordPress.com account already then you can use that, or you can create a new one.”

What should happen?
You should be logged in.

Clicking the giant blue “sign in with wordpress” button has the same redirect loop.

Time to roll up the sleeves… extended debugging:

GET https://en.gravatar.com/connect/
cookie:logged-out=true; redirect-after-auth=https%3A%2F%2Fen.gravatar.com%2Femails%2F
referer:https://en.gravatar.com/site/login

RESPONSE
302 https://public-api.wordpress.com/oauth2/authorize?client_id=1854&response_type=code&blog_id=0&state=UNIQUE_HASHED_STATE&redirect_uri=https%3A%2F%2Fen.gravatar.com%2Fconnect%2F%3Faction%3Drequest_access_token
set-cookie:__wpcc=UNIQUE_HASH; secure; HttpOnly

GET https://public-api.wordpress.com/oauth2/authorize?client_id=1854&response_type=code&blog_id=0&state=UNIQUE_HASHED_STATE&redirect_uri=https%3A%2F%2Fen.gravatar.com%2Fconnect%2F%3Faction%3Drequest_access_token
cookie:_wpndash=GARBLE_GARBLE; wordpress_eli=1; wp_api_sec=daemonsadvocate%7CGARBLE_GARBLE; _oklv=GARBLE_GARBLE; _okdetect=GARBLE_GARBLE; _okbk=GARBLE_GARBLE; _ok=GARBLE_GARBLE; wcsid=GARBLE_GARBLE; tk_tc=GARBLE_GARBLE; tk_ai=GARBLE_GARBLE; dcmsid=GARBLE_GARBLE; tk_qs=; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in=daemonsadvocate%7CGARBLE_GARBLE

RESPONSE
302 https://en.gravatar.com/connect/?action=request_access_token&code=UNIQUE_HASHED_CODE&state=UNIQUE_HASHED_STATE

GET https://en.gravatar.com/connect/?action=request_access_token&code=UNIQUE_HASHED_CODE&state=UNIQUE_HASHED_STATE

cookie:__wpcc=UNIQUE_HASH; logged-out=true; redirect-after-auth=https%3A%2F%2Fen.gravatar.com%2Femails%2F

RESPONSE 200
set-cookie:__wpcc=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; secure; HttpOnly

I’m guessing someplace in the background that gravatar is asking wordpress.com for UNIQUE_HASHED_STATE and getting derp for some amount of time after password reset.

Props to the x-hacker headers put in by the automattic WP team. Very cool.
timethief · Member · Apr 10, 2017 at 9:15 pm
Copy link
When we need Staff help with issues Volunteers cannot resolve like this one we type modlook into the sidebar tags on our forum threads. I did that for you. How do I get a Moderator/Staff reply for my question? https://en.support.wordpress.com/getting-help-in-the-forums/#how-do-i-get-a-moderatorstaff-reply-for-my-question Then we subscribe to this thread so we are notified when they respond. To subscribe look in the sidebar of this thread, find the subscribe to topics link and click it.
gattyme · Member · Apr 10, 2017 at 9:19 pm
Copy link
Cool bananas! Thanks @timetheif.
supernovia · Staff · Apr 10, 2017 at 9:47 pm
Copy link
Hah, nice username daemonsadvocate :) And thank you for the details. I’ve also duplicated this and filed an issue with our Gravatar team so they can take a look.

Normally, you would need to use the WordPress.com sign on, however it shouldn’t loop after that.

Thanks everyone for your patience!
coachlisanne · Member · Apr 11, 2017 at 12:00 am
Copy link
Thanks everyone – for the traction on this topic and helping it move forward to get fixed.

I was able to change my gravatar by going through the settings in WordPress, rather than trying to login via Gravatar.
supernovia · Staff · Apr 11, 2017 at 6:52 pm
Copy link
We’ll update you here when we have more info. Cheers, all :)
jeherve · Staff · Apr 20, 2017 at 12:21 am
Copy link
@daemonsadvocate Would you mind giving this another try now? We’ve made some changes to our log-in system that should solve the issue.

Thanks!

No items found.