Fix Google SSO Login Loops
Budget: €6 – €12 EUR
Description
We are experiencing critical issues with Google Single Sign-On and session management on our PHP web application (jobalize.it). The application is used by multiple companies and features both classic email/password login and Google SSO (OAuth). Recent updates to our authentication and session code have completely broken login behavior:
Current problems
Google SSO does not prompt for account selection and redirects users to the homepage without logging them in. No session is set, and no errors are displayed.
Regular email/password login will always log in as the same user, regardless of credentials. Access to user pages (like community and profile) is blocked, or the system redirects to login or home, even after successful login.
- The session is not consistently set or destroyed, causing security risks and unpredictable behavior.
- Sometimes, logging out does not clear the session, and users access the wrong profile (session hijacking risk).
- The Google OAuth redirect URI is correctly configured; the code parameter does NOT always reach the PHP backend as expected.
- Debugging shows that the login callback does not properly process the OAuth code or set the correct user session.
Tech stack & details
- Backend: PHP 7/8
- Frontend: HTML, JS, jQuery
- OAuth: Google API Client Library (PHP, via Composer)
- Database: MySQL
- Hosted on shared hosting with HTTPS enabled
- Project structure available (main login/logout/profile pages)
What needs to be fixed
- Diagnose the Google SSO flow: ensure users can always select their Google account and get properly logged in.
- Make regular login work normally, always setting the correct user session based on credentials.
- Ensure only authorized, correct users access their profile, colleagues, community, etc.
- Logout must securely clear session and prevent session hijacking.
- Secure session initialization/validation and PHP session cookie settings.
- Add logging/debug traces to help future diagnosis.
- Audit, refactor, and document the code changes.
Who should apply
- Experienced PHP developer with Google OAuth and session management expertise.
- Solid background in web application security and debugging authentication flows.
- Ability to communicate in English (code comments and documentation required).
We are experiencing critical issues with Google Single Sign-On and session management on our PHP web application (jobalize.it). The application is used by multiple companies and features both classic email/password login and Google SSO (OAuth). Recent updates to our authentication and session code have completely broken login behavior:
Current problems
Google SSO does not prompt for account selection and redirects users to the homepage without logging them in. No session is set, and no errors are displayed.
Regular email/password login will always log in as the same user, regardless of credentials. Access to user pages (like community and profile) is blocked, or the system redirects to login or home, even after successful login.
- The session is not consistently set or destroyed, causing security risks and unpredictable behavior.
- Sometimes, logging out does not clear the session, and users access the wrong profile (session hijacking risk).
- The Google OAuth redirect URI is correctly configured; the code parameter does NOT always reach the PHP backend as expected.
- Debugging shows that the login callback does not properly process the OAuth code or set the correct user session.
Tech stack & details
- Backend: PHP 7/8
- Frontend: HTML, JS, jQuery
- OAuth: Google API Client Library (PHP, via Composer)
- Database: MySQL
- Hosted on shared hosting with HTTPS enabled
- Project structure available (main login/logout/profile pages)
What needs to be fixed
- Diagnose the Google SSO flow: ensure users can always select their Google account and get properly logged in.
- Make regular login work normally, always setting the correct user session based on credentials.
- Ensure only authorized, correct users access their profile, colleagues, community, etc.
- Logout must securely clear session and prevent session hijacking.
- Secure session initialization/validation and PHP session cookie settings.
- Add logging/debug traces to help future diagnosis.
- Audit, refactor, and document the code changes.
Who should apply
- Experienced PHP developer with Google OAuth and session management expertise.
- Solid background in web application security and debugging authentication flows.
- Ability to communicate in English (code comments and documentation required).