Automattic\WooCommerce\Admin\API

MobileAppQRLogin::get_secure_site_url │ private │ WC 1.0

Validate that the configured site URL is HTTPS and return it.

is_ssl() tells us the current REQUEST is HTTPS — it says nothing about the canonical site URL WordPress is configured to advertise. get_site_url() is also insufficient because it passes its result through set_url_scheme(), which rewrites the scheme to match is_ssl() so get_site_url() return https://… whenever the request happens to be HTTPS, masking a stale http:// siteurl option underneath. We therefore check the RAW stored option, which is what reflects admin configuration and what shows up in reset-password emails, webhooks, canonical redirects, etc. If that is http://, a misconfigured proxy that terminated TLS before reaching PHP could still cause this endpoint to hand the mobile app a cleartext site URL for the token-exchange POST.

We deliberately reject (rather than silently normalizing to https://) because:

  1. The misconfig usually affects other things (reset-password emails, 
    webhooks, canonical redirects). Failing loudly surfaces it.
    1. Normalizing assumes the site actually serves HTTPS on the same host, 
      which we cannot verify from within a single request.
    2. A 500 is strictly safer than a leaky success.

Method of the class: MobileAppQRLogin{}

No Hooks.

Returns

String|\WP_Error. The HTTPS site URL, or a WP_Error if it is not HTTPS.

Usage

// private - for code of main (parent) class only
$result = $this->get_secure_site_url();

MobileAppQRLogin::get_secure_site_url() code WC 11.0.1

woocommerce/src/Admin/API/MobileAppQRLogin.php 
private function get_secure_site_url() {
	// Raw option: what the admin actually configured, before `set_url_scheme()`
	// inside `get_site_url()` normalizes it based on the current request's scheme.
	$raw_site_url = get_option( 'siteurl' );
	$raw_scheme   = is_string( $raw_site_url ) ? wp_parse_url( $raw_site_url, PHP_URL_SCHEME ) : null;

	if ( 'https' !== $raw_scheme ) {
		return new \WP_Error(
			'insecure_site_url',
			__( 'QR login cannot be used because the site URL is not configured for HTTPS. Please update the WordPress Address (URL) in Settings → General to use https://.', 'woocommerce' ),
			array( 'status' => 500 )
		);
	}

	// Use get_site_url() for the returned value so any scheme normalization
	// or filtering that WordPress applies downstream is preserved, then
	// validate the final value too. A plugin can still filter `site_url`
	// after the raw option check above; never hand the mobile app an
	// HTTP exchange target.
	$site_url     = get_site_url();
	$final_scheme = wp_parse_url( $site_url, PHP_URL_SCHEME );

	if ( 'https' !== $final_scheme ) {
		return new \WP_Error(
			'insecure_site_url',
			__( 'QR login cannot be used because the site URL is not configured for HTTPS. Please update the WordPress Address (URL) in Settings → General to use https://.', 'woocommerce' ),
			array( 'status' => 500 )
		);
	}

	return $site_url;
}