Uncaught exception during setup when missing `site_id` or `site_code`

Bug Description

One user in the support forums is encounter problems when trying to set up the plugin. They were a one stage encountering a set up loop, I suspect redirecting after signing in with their Google account.

At present their set up experience is described as following:

1. They attempt set up using the standard method
2. During OAuth, after selecting their Google account, after they click on continue after granting permissions (I suspect all permissions are granted) they land on a dashboard error. “There has been a critical error on this website. Please check your site admin email inbox for instructions.”
3. Their email contains the below:

Howdy!

Since WordPress 5.2 there is a built-in feature that detects when a plugin or theme causes a fatal error on your site, and notifies you with this automated email.

In this case, WordPress caught an error with one of your plugins, Site Kit by Google.

First, visit your website (https://www.###.com/) and check for any visible issues. Next, visit the page where the error was caught (https://www.###.com/wp-admin/index.php?action=googlesitekit_proxy_exchange_site_code&googlesitekit_code=sitekit-rcDaMfqrYJWXFikmUBFnCL&googlesitekit_site_code=4%2F0AX4XfWhKHHDJmD3PvczgOX2jLdIdGUEh4GyJ3kZ4UvDwx1iBxqAK5ZQhiv3cTxxR6GSMHg&nonce=877226ee58&step=verification) and check for any visible issues.

Please contact your host for assistance with investigating this issue further.

If your site appears broken and you can't access your dashboard normally, WordPress now has a special "recovery mode". This lets you safely login to your dashboard and investigate further.

https://www.###.com/wp-login.php?action=enter_recovery_mode&rm_token=DAAnJxp0UXLshLeHFlBQFP&rm_key=6Ih3uVhzdbBdE4KaLwct1e

To keep your site safe, this link will expire in 1 day. Don't worry about that, though: a new link will be emailed to you if the error occurs again after it expires.

When seeking help with this issue, you may be asked for some of the following information:
WordPress version 6.0
Active theme: ### (version 1.0)
Current plugin: Site Kit by Google (version 1.75.0)
PHP version 7.4.15

Error Details
=============
An error of type E_ERROR was caused in line 145 of the file /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Google_Proxy.php. Error message: Uncaught Exception: Missing site_id or site_code parameter for setup URL. in /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Google_Proxy.php:145
Stack trace:
#0 /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Setup.php(327): Google\Site_Kit\Core\Authentication\Google_Proxy->setup_url()
#1 /home/webuser/websites/###/public_html/wp-content/plugins/google-site-kit/includes/Core/Authentication/Setup.php(238): Google\Site_Kit\Core\Authentication\Setup->redirect_to_proxy()
#2 /home/webuser/websites/###/public_html/wp-includes/class-wp-hook.php(307): Google\Site_Kit\Core\Authentication\Setup->handle_action_exchange_site_code()
#3 /home/webuser/websites/###/public_html/wp-includes/class-wp-hook.php(331): WP_Hook->apply_filters()
#4 /home/webuser/websites/###/public_html/wp-includes/plugin.php(476

The user has tried the same with Site Kit as the only plugin active (via the Health Check & Troubleshooting plugin)

We did have a similar error that was reported as a bug previously, since addressed (https://github.com/google/site-kit-wp/issues/3830), with compile errors now including SK information (https://github.com/google/site-kit-wp/issues/3896).

Screenshots

The full video of this experience can be found within the impacted users Site Health information report.

Additional Context

• Site Kit v1.75.0
• Support Topic | Site Health information
• Occurs incognito
• No obvious from reviewing their SH info
• Chrome incognito with Health Check & Troubleshooting results in the same
• There is one critical error in their SH status, “Background updates are not working”
• Video of experience found here
• No CDN evident

Insights & Troubleshooting Checks performed

• Health Check & Troubleshooting plugin check
• Front end check (mixed content, minified content, combined JS)
• Incognito mode
• Checked users Site Health info, no identified causes
• Additional .htaccess rules applied - True
• Uninstalled and reinstalled plugin
• User confirmed no ““Critical errors”” in their Site Health status - Background updates are not working
• Temporary disabled WAF rules at host level - including ModSecurity
• Checked site setup and dashboard from another WordPress site on the same hosting platform
• Reset Site Kit
• Checked does the same occur from another Google account during OAuth
• Reviewed error logs
• Reviewed XHR requests
• Change PHP version

---

Do not alter or remove anything below. The following sections will be managed by moderators only.

Acceptance criteria

• Google_Proxy::setup_url should no longer throw exceptions

Implementation Brief

Test Coverage

QA Brief

Changelog entry

[felixarntz]

@aaemnnosttv

I suppose someone could be using it improperly – can you see any other way this could happen? Google_Proxy::exchange_site_code will return a WP_Error if the site_id or site_secret aren’t set, but is it possible they could be returned as empty strings?

I don’t think that can happen from the API response. So I would think some code is doing something wrong there indeed.

I think we should investigate this further, but I don’t think it is a critical bug, I assume there is some third-party code involved in this. 🤔

[FlicHollis]

Hi @aaemnnosttv if you are not actively working on this, could you un-assign yourself so someone else can pick up? Thanks!