Uncaught exception during setup when missing site_id or site_code

[jamesozzie]

Bug Description

One user in the support forums is encounter problems when trying to set up the plugin. They were at one stage encountering a set up loop, I suspect redirecting after signing in with their Google account.

At present their set up experience is described as following:

1. They attempt set up using the standard method
2. During OAuth, after selecting their Google account, after they click on continue after granting permissions (I suspect all permissions are granted) they land on a dashboard error. "There has been a critical error on this website. Please check your site admin email inbox for instructions."
3. Their email contains the below:

Howdy!

Since WordPress 5.2 there is a built-in feature that detects when a plugin or theme causes a fatal error on your site, and notifies you with this automated email.

In this case, WordPress caught an error with one of your plugins, Site Kit by Google.

First, visit your website (https://www.###.com/) and check for any visible issues. Next, visit the page where the error was caught (https://www.###.com/wp-admin/index.php?action=googlesitekit_proxy_exchange_site_code&googlesitekit_code=sitekit-rcDaMfqrYJWXFikmUBFnCL&googlesitekit_site_code=4%2F0AX4XfWhKHHDJmD3PvczgOX2jLdIdGUEh4GyJ3kZ4UvDwx1iBxqAK5ZQhiv3cTxxR6GSMHg&nonce=877226ee58&step=verification) and check for any visible issues.

Please contact your host for assistance with investigating this issue further.

If your site appears broken and you can't access your dashboard normally, WordPress now has a special "recovery mode". This lets you safely login to your dashboard and investigate further.

https://www.###.com/wp-login.php?action=enter_recovery_mode&rm_token=DAAnJxp0UXLshLeHFlBQFP&rm_key=6Ih3uVhzdbBdE4KaLwct1e

To keep your site safe, this link will expire in 1 day. Don't worry about that, though: a new link will be emailed to you if the error occurs again after it expires.

When seeking help with this issue, you may be asked for some of the following information:
WordPress version 6.0
Active theme: ### (version 1.0)
Current plugin: Site Kit by Google (version 1.75.0)
PHP version 7.4.15

Error Details
=============
An error of type E_ERROR was caused in line 145 of the file /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Google_Proxy.php. Error message: Uncaught Exception: Missing site_id or site_code parameter for setup URL. in /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Google_Proxy.php:145
Stack trace:
#0 /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Setup.php(327): Google\Site_Kit\Core\Authentication\Google_Proxy->setup_url()
#1 /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Setup.php(238): Google\Site_Kit\Core\Authentication\Setup->redirect_to_proxy()
#2 /home/webuser/websites/###/public_html/wp-includes/class-wp-hook.php(307): Google\Site_Kit\Core\Authentication\Setup->handle_action_exchange_site_code()
#3 /home/webuser/websites/###/public_html/wp-includes/class-wp-hook.php(331): WP_Hook->apply_filters()
#4 /home/webuser/websites/###/public_html/wp-includes/plugin.php(476

The user has tried the same with Site Kit as the only plugin active (via the Health Check & Troubleshooting plugin)

We did have a similar error that was reported as a bug previously, since addressed (#3830), with compile errors now including SK information (#3896).

Screenshots

The full video of this experience can be found within the impacted users Site Health information report.

Additional Context

• Site Kit v1.75.0
• Support Topic | Site Health information
• Occurs incognito
• No obvious from reviewing their SH info
• Chrome incognito with Health Check & Troubleshooting results in the same
• There is one critical error in their SH status, "Background updates are not working"
• Video of experience found here
• No CDN evident

Insights & Troubleshooting Checks performed

• Health Check & Troubleshooting plugin check
• Front end check (mixed content, minified content, combined JS)
• Incognito mode
• Checked users Site Health info, no identified causes
• Additional .htaccess rules applied - True
• Uninstalled and reinstalled plugin
• User confirmed no ""Critical errors"" in their Site Health status - Background updates are not working
• Temporary disabled WAF rules at host level - including ModSecurity
• Checked site setup and dashboard from another WordPress site on the same hosting platform
• Reset Site Kit
• Checked does the same occur from another Google account during OAuth
• Reviewed error logs
• Reviewed XHR requests
• Change PHP version

---

Do not alter or remove anything below. The following sections will be managed by moderators only.

Acceptance criteria

• Google_Proxy::setup_url should no longer throw exceptions

Implementation Brief

Test Coverage

QA Brief

Changelog entry

[aaemnnosttv]

@felixarntz we currently don't catch this anywhere it's used so it seems like it shouldn't throw, especially as there doesn't seem to be a clear action to take if it would. Thoughts?

[felixarntz]

@aaemnnosttv We don't catch it anywhere because not passing any of the two arguments there would be an error on our part. The old Google_Proxy::setup_url() function (prior to serviceSetupV2) didn't require any of these arguments, but since then it has been required. So if this is caused by our plugin, it is a critical bug in our code we need to fix. If this is caused by some other code outside our plugin calling the method incorrectly, the other code needs to be fixed.

In other words, this should still throw because it indicates a critical incorrect usage within the codebase itself. If this gets thrown without another plugin being involved, it's something critical we have to investigate and fix.

Basically, you could consider this similar to a PHP error where we are not passing a required method parameter.

[aaemnnosttv]

@felixarntz that makes sense. It looks like the only way this error would be possible is here by passing an empty site_id and no site_code (even though one is present):

site-kit-wp/includes/Core/Authentication/Setup.php

Lines 236 to 238 in a16315e

	$site_id = ! empty( $credentials['oauth2_client_id'] ) ? $credentials['oauth2_client_id'] : '';
	$this->redirect_to_proxy( $code, compact( 'site_id', 'step' ) );

I can't see how this could happen though as it seems like it would require the site code exchange to fail somehow without throwing. Essentially not having credentials by the end of the handle_action_exchange_site_code call.

After playing with this a bit, I found it is possible to force this using the filter:

add_filter( 'googlesitekit_oauth_secret', function () {
	$web = [
		'client_id'     => '',
		'client_secret' => '',
	];

	return compact( 'web' );
} );

I suppose someone could be using it improperly – can you see any other way this could happen? Google_Proxy::exchange_site_code will return a WP_Error if the site_id or site_secret aren't set, but is it possible they could be returned as empty strings?

[felixarntz]

@aaemnnosttv

I suppose someone could be using it improperly – can you see any other way this could happen? Google_Proxy::exchange_site_code will return a WP_Error if the site_id or site_secret aren't set, but is it possible they could be returned as empty strings?

I don't think that can happen from the API response. So I would think some code is doing something wrong there indeed.

I think we should investigate this further, but I don't think it is a critical bug, I assume there is some third-party code involved in this. 🤔

[FlicHollis]

Hi @aaemnnosttv if you are not actively working on this, could you un-assign yourself so someone else can pick up? Thanks!

[aaemnnosttv]

@jamesozzie have there been any recent reports of this? It sounds like something we'd definitely want to fix but one that isn't common or easy to reproduce under reasonable circumstances.

[jamesozzie]

@aaemnnosttv We've encountered no recent reports of this. We only came across a single time in total.

[alex-maereanu]

Happening for me too!

[jamesozzie]

Hi @alex-maereanu. We'd be happy to look into your case if you'd like to open a support topic over on the plugins WordPress support forums.

Please include all relevant details in order for us to assist. This may include sharing your Site Health information, so we can check your site and your current AdSense status.

If we can find any useful additional insights we can also add them to this GitHub issue, which may be useful given it's likely others are encountering the same. I'll keep an eye out for your topic. Thank you.

[strarsis]

Encountered this issue today with a new site.

[jamesozzie]

@strarsis As directly above, we'd be happy to assist you with this if you'd like to open a support topic over on the plugins WordPress support forums. If the experience you're facing is the same as described in the issue we may need to make some changes within the plugin, hopefully however, we can determine more when working with you from a support topic.

[strarsis]

@jamesozzie: I created a new support topic in the WordPress support forum for the plugin:
https://wordpress.org/support/topic/php-fatal-error-at-initial-setup-missing-site_id-or-site_code-parameter-for-s/

[andizer]

Today I've experienced the same issue for a website we are building. We see the same errors provided in the WordPress support ticket above. For reference, here is the one we've:

FastCGI sent in stderr: "PHP message: PHP Fatal error:  Uncaught Exception: Missing site_id or site_code parameter for setup URL. in /home/public_html/app/plugins/google-site-kit/includes/Core/Authentication/Google_Proxy.php:139
Stack trace:
#0 /home/public_html/app/plugins/google-site-kit/includes/Core/Authentication/Setup.php(384): Google\Site_Kit\Core\Authentication\Google_Proxy->setup_url()
#1 /home/public_html/app/plugins/google-site-kit/includes/Core/Authentication/Setup.php(295): Google\Site_Kit\Core\Authentication\Setup->redirect_to_proxy()
#2 /home/public_html/wp/wp-includes/class-wp-hook.php(308): Google\Site_Kit\Core\Authentication\Setup->handle_action_exchange_site_code()
#3 /home/public_html/wp/wp-includes/class-wp-hook.php(332): WP_Hook->apply_filters()
#4 /home/public_html/wp/wp-includes/plugin.php(517): WP_Hook->do_action()

Because of curiosity I attempted to debug it a little bit with the codebase alongside. What I've discovered is that we got stuck here: https://github.com/google/site-kit-wp/blob/develop/includes/Core/Authentication/Google_Proxy.php#L138.
The exception says site_id or site_code is missing. The if-statement checks if both are present or not. It is intended that both fields needs to be present? Or is just one of both fine enough?

I also can confirm we have a site_code, but the site_id isn't present in the url we are redirect during the flow. More interesting it that it also isn't retrieved and assigned in the Setup::handle_action_exchange_site_code. Based on the flow in that method I suppose that Setup::handle_site_code is giving an exception. Leading us to this situation, because of the catch-statement. So far. This is all the information I've found out.

[jamesozzie]

@andizer Really appreciate you sharing your insights into this. If you'd like to open a support topic we'd be happy to work with you on this. After opening a support topic you may wish to share any invalid response, maybe via the Log HTTP Requests plugin or XHR. If sharing this, please share via this form only (referencing your own support topic). The request for sitekit.withgoogle.com/o/oauth2/site/](http://sitekit.withgoogle.com/o/oauth2/site/ in particular may be of use.

In relation to the site_code and site_id fields required, both are required in order to proceed.

If we can determine additional insights based on your setup, with the details you provide, we can revisit this GitHub issue and add notes based on your experience.

[felixarntz]

@andizer @jamesozzie To clarify, only one of site_code or site_id is required. The exception is only thrown if both fields are empty, so that's correct.

I'm unsure what leads to the exception being thrown as the logic itself looks right. The exception is only thrown if neither of the parameters is present.

[strarsis]

The error still persists on the affected site. This is the URL that causes the exception during the Google Site Kit set-up:
https://<redacted>/wp/wp-admin/index.php?action=googlesitekit_proxy_exchange_site_code&googlesitekit_code=sitekit-<redacted>&googlesitekit_site_code=<redacted>&nonce=<redacted>&step=verification
googlesitekit_site_code is set, but googlesitekit_site_id is missing, why is it missing, why does not Google Site Kit fail when constructing the redirection URL where site_id is already missing?

[jamesozzie]

@strarsis As the error persists for you, I've reopened your support topic. Based on what you shared above, it looks like you have your WordPress files in a wp folder. If you had Site Kit setup previously without this wp directory, and then moved your files without resetting the plugin, it's possible to encounter errors.

I'll leave a note in your support topic and we can communicate from there.

[strarsis]

WordPress files in a wp folder

Good point. Though the WordPress file always had been in that folder. Other sites using the same layout work correctly.
I submitted the technical information / plugin support form for https://wordpress.org/support/topic/php-fatal-error-at-initial-setup-missing-site_id-or-site_code-parameter-for-s/.