The following function that we have in a plugin a developer helped us create (he is no longer available) is giving errors when debugging is on once we updated the site from WP 4.9 to WP 5.3. Wondering if anything obvious is incorrect or deprecated now?

    add_action( 'wp_login_failed', array( $this, 'handle_failed_login' ) );     

    function handle_failed_login() {
    $referrer = $_SERVER['HTTP_REFERER']; 
    if ( ! empty( $referrer ) && ! strstr( $referrer,'wp-login' ) && !strstr( $referrer,'wp-admin' ) ) {
        $url = $this->parse_build_failed_login_url( $referrer );
        wp_redirect( $url ); 
        exit;
    }
}

    function parse_build_failed_login_url( $url ){ 
    $parsed_url = parse_url( $url );
    $url = ( isset( $parsed_url['scheme'] ) ) ? $parsed_url['scheme'] .'://' : '';
    $url .= ( isset( $parsed_url['host'] ) ) ? $parsed_url['host'] : '';
    $url .= ( isset( $parsed_url['path'] ) ) ? $parsed_url['path'] : '';
    $url .= '?login=failed#disclaimer-wrap';
    return $url;
}   

The error we get is:

Warning: Cannot modify header information - headers already sent by (output started at /path-to-our-plugin:line#) in /wp-includes/pluggable.php on line 961-970, 973-976, 979-982, 985

The code in pluggable.php appears to be setting or clearing authentication cookies. The line # referenced in the error is the '$referrer = $_SERVER...' line.

The function is to stop the default redirection to the basic WordPress login error page (/wp-login.php) when a user enters incorrect login credentials on the login form we include on certain pages. These pages require a login to access a download, and we have login errors remaining on the page, not redirecting away. We're basically keeping the login process inline on page, not on a separate default WP page.

When debugging is 'false', the action does seem to still work correctly, but I don't want to ignore the errors if important.