Fix: Made the full “Continue with Google” OAuth button flow more reliable when browsers do not return the temporary state cookie after Google’s redirect.
2.2.3
Fix: Added clearer setup wizard save failure notices when Google OAuth credentials fail validation.
Fix: Improved setup wizard redirects so failed saves stay on the current step and successful saves advance only after WordPress processes the settings update.
2.2.2
Fix: Improved setup wizard saves so each step reliably persists the intended settings before continuing.
Fix: Ensured the Google login page always receives the required CSRF state token before initiating sign-in.
Compatibility: Tested with WordPress 7.0.
2.2.1
Fix: Resolved a persistent Google OAuth setup notice showing even when valid credentials were already configured.
Maintenance: Confirmed removal of development-only combined_contents.txt from distributable plugin files.
2.2.0
Improvement: Intermediary page on both button as well as one tap signup
2.1.9
Improvement: Removed the “Login Expereince by HardToSkip” footer from public facing pages
2.1.8
Improvement: Made the “Login Expereince by HardToSkip” footer non-sticky
2.1.7
Improvement: Only show the Login Expereince by HardToSkip on homepage
2.1.6
Hotfix: Added subdomain/external host whitelisting for custom login redirects. This fixes the issue where redirects to subdomains (like app.example.com) were being blocked by WordPress security filters.
2.1.5
New Feature: Added Role-Based Login Redirects. You can now configure custom landing pages (like the homepage) for specific user roles instead of the default /wp-admin redirect.
Enhancement: Improved settings sanitization for URL fields to ensure security while maintaining query parameter integrity.
Security: Enforced wp_safe_redirect for all login flows to prevent Open Redirect vulnerabilities.
2.1.4
Fatal Error Fix: Resolved a fatal error (Call to undefined function is_user_logged_in()) caused by the plugin loading before the WordPress core was fully initialized.
“Headers Already Sent” Fix: Eliminated PHP warnings by moving all cookie-setting operations to appropriate early-loading hooks (template_redirect and login_init), preventing conflicts with themes and other plugins.
Code Refactoring: Improved the reliability of the authentication flow by refactoring how the CSRF and OAuth state tokens are generated and handled.
2.1.3
Feature: Added an option to disable standard WordPress password-based authentication, allowing administrators to enforce a Google-only login policy for enhanced security.
Enhancement: The login page UI now adapts based on whether password login is disabled, ensuring a seamless user experience.
Enhancement: Updated plugin description and FAQ to reflect the new optional passwordless functionality.
2.1.2
Security: Hardened security by adding nonce verification to the login error display and One Tap callback handlers to prevent Cross-Site Request Forgery (CSRF) vulnerabilities.
Security: Implemented the recommended OAuth 2.0 state parameter validation during the standard Google Sign-In flow to protect against CSRF attacks.
Security: Improved data sanitization on the admin settings page to ensure redirect URLs are handled securely.
Fix: Corrected a bug where the “Please configure your Google OAuth credentials” admin notice would persist even after the plugin was fully configured.
Enhancement: Updated the readme.txt to include a comprehensive “External Services” section, clearly documenting the use of Google APIs as required by WordPress plugin guidelines.
