Can't preview starter content "Home" menu item in subdirectory installation

[dlh]

To replicate, install trunk into a subdirectory, preview Twenty Seventeen with its starter content, and attempt to navigate to the "Home" menu item. Instead of the preview, you get a "Cheatin'" error.

As far as I can tell, the cause of this behavior starts with get_option() stripping trailing slashes from home_url().

get_theme_starter_content() calls home_url() as part of building its 'nav_menus' array as of [39561]. When the home URL is a subdirectory, the resulting URL is always example.com/wp instead of example.com/wp/.

Later, inside the Customize preview, the resulting URL of the "Home" menu item looks like:

http://example.com/wp?customize_changeset_uuid=1234.

Clicking the link leads to the error page because (and here I'm not quite certain) the user's authentication cookie isn't sent to the server with a request for example.com/wp. So, no user is logged in when the Customizer checks authentication -- first in WP_Customize_Widgets::__construct(), then in WP_Customize_Manager::customize_preview_init().

The problem doesn't occur when WordPress is in the root because appending the changeset ID in JS (via element.search in prepareLinkPreview()) automatically appends the trailing slash, at least in Chrome and Firefox. Before that, I think [25681] handled it.

Assuming the above is correct, a relatively low-impact way to address the issue is to trailing-slash home_url() in get_theme_starter_content(), which the attached patch would do.

However, any link to example.com/wp in the preview is affected, even before 4.7. The starter content only makes the issue more noticeable. So a more general fix in JS might also be worthwhile.

[celloexpressions]

Patch seems like a logical fix to me.

[swissspidy]

This should rather use home_url( '/' ) I think.

[dlh]

Indeed, thanks @swissspidy.

[westonruter]

I can't reproduce the issue with a cheatin' error being reported in Chrome or Firefox. I believe I have the same subdirectory installation set up, and clicking on the Home nav menu item which points to http://subdirectory-install.vvv/src?customize_changeset_uuid=b1559c90-a07c-4f54-b447-fd8bd62c615c&customize_messenger_channel=preview-2 doesn't result in an error. As noted in the description, for some reason the trailing slash on the the cookie path is causing it to not be sent to a non-trailingslashed URL, even though it is working for me.

In any case, clicking the home link without the trailing slash does, however, result in a 301 redirect to /src/?customize_changeset_uuid=..., so at the very least 40112.2.diff​ is more correct because it eliminates an extra redirect when going home.

[westonruter]

In 40300:

Customize: Trailingslash the home nav menu item URL in starter content.

This prevents an additional 301 redirect when clicking on the nav menu item, and it also prevents a scenario where the auth cookie may not be passed and cause an authentication error when navigating in the customizer.

Props dlh, swissspidy.
Fixes #40112.

[westonruter]

Re-opening for consideration in 4.7.4

[swissspidy]

In 40338:

Customize: Trailingslash the home nav menu item URL in starter content.

This prevents an additional 301 redirect when clicking on the nav menu item, and it also prevents a scenario where the auth cookie may not be passed
and cause an authentication error when navigating in the customizer.

Props dlh, swissspidy.
Fixes #40112.

Merges [40300] to the 4.7 branch.