Login Mutation Redirect Causes CORS Error

[JackLeggeRumbl]

Describe the issue

I'm unable to perform user login via the GraphQL login mutation when using WooNuxt with a live WordPress backend (headless setup). Login attempts trigger a 302 redirect to /, causing CORS errors and failed requests on the Nuxt frontend.

Project Setup Details

• Using latest WooNuxt Starter
• Nuxt frontend running locally on https://localhost:3000
• Live WordPress backend at https://headless.bloomsburyfootball.com
• WooCommerce + WPGraphQL + Headless Login + WooNuxt Settings + WooGraphQL Pro + WPGraphQL CORS plugins installed
• Password login provider enabled in Headless Login plugin

Relevant .env for Nuxt:

GQL_HOST="https://headless.bloomsburyfootball.com/graphql"
APP_HOST="https://localhost:3000"

What Happens

• login GraphQL mutation sent from Nuxt → https://headless.bloomsburyfootball.com/graphql
• Server responds with 302 Redirect to /
• Browser follows redirect, hitting /
• That request fails due to missing/invalid CORS headers and no GraphQL response

Network Example:

Initial POST to /graphql → 302

Redirect to / → 403 Forbidden or HTML response

Console CORS errors:

• Access-Control-Allow-Origin missing
• Cross-Origin Request Blocked

What We've Tried

• Ensured CORS headers present via functions.php for /graphql requests
• Removed WooCommerce and AutomateWoo template redirects for GraphQL requests
• Disabled known forced redirects during GraphQL requests
• Headless Login Password Provider is enabled
• /graphql accepts test queries like { __typename } without redirect
• WooCommerce "My Account" and "Login" page assignments removed

Despite this, login mutation still redirects, causing cross-origin failure.
Expected Behaviour

• Login mutation returns JSON response with authToken as per WPGraphQL Headless Login plugin
• No 302 redirect
• CORS headers respected for frontend at https://localhost:3000

Questions

• Is WooNuxt enforcing redirects for unauthenticated users unexpectedly?
• Any known compatibility issues with Headless Login, WooCommerce, or session handling for this setup?

Please advise on any known fixes or best practices — thanks in advance!

[scottyzen]

Hi @JackLeggeRumbl,

Can you set me up with a test account on your site? I can then try to reproduce the issue and see if I can find a solution. I can see that products are being displayed correctly, so I don't think it's a CORS issue, but rather a problem with the login flow or the way the GraphQL endpoint is handling the request.

http://localhost:3000/ is working for you.

I tried to set up a user there, but it looks like the confirmation email is not being sent, so I can't go any further with that.

[adamboother]

Hi @scottyzen,

We're still having the issue mention above despite trying a few fixes since everything that Jack mentioned.

I'm not sure if you received my email on the 25th July but I set up your test account on headless.bloomsburyfootball.com. Your username is: scottyzen and I've just emailed the password to you.

We are able to retrieve blocks from pages, products, menus etc, so the issue is just isolated to login.

Could you please see if you can spot any issues with the login flow/GraphQL endpoint?

[nazeemK]

Getting the same login issues. Any idea what might be causing this?