Set Short Automatic Logout Time for One User

Question

I am building sites where I secretly give authoring role capability to visitors by auto-logging them into a generic account; they never see the admin bar, and are prevented from seeing the dashboard (with Remove Dashboard Access plugin).

Everything works fine except I would like to have the site automatically log out after a short time frame, like an hour. I have been trying the approach here https://wordpress.stackexchange.com/a/51887/14945 This and others work by changing the auth_cookie_expiration for all users, not what I want (admins and editors need regular settings).

I call a function I use elsewhere to verify the current user is the generic account (login name = 'collector')

function trucollector_check_user( $allowed='collector' ) {
    // checks if the current logged in user is who we expect
    global $current_user;
    get_currentuserinfo();

    // return check of match
    return ( $current_user->user_login == $allowed );
}

and this is my cookie changing function

function trucollector_change_cookie_logout( $expiration, $user_id, $remember ) {
    return $remember ? $expiration : 3600;
}

What I am stuck on is where to call the add_filter where I can check for the correct user; I have tried putting in a function called on an action of after_setup_theme

add_action('after_setup_theme', 'trucollector_shorten_cookie');

function trucollector_shorten_cookie() {
        // change to short auto logout time
        if ( trucollector_check_user() ) {
            add_filter( 'auth_cookie_expiration', 'trucollector_change_cookie_logout', 99, 3 );
        }

}

It looks like when I inspect the cookies in my browser that there is a shorter one set, but it does not seem to be logging out my guest user.

Most likely my logic here is missing something....

Answer 1

One approach can be to log the time a user is logging in at by using:

function user_last_login($user_login, $user) {
   update_user_meta($user - > ID, 'last_login', time());
}
add_action('wp_login', 'user_last_login', 10, 2);

and then checking if the time is passed:

add_action('get_header', 'processOnPageLoad', 1 );
add_action('admin_init', 'processOnPageLoad', 1 );
function processOnPageLoad() {
if( is_user_logged_in() && condition_to_check_required_user ) {
      $last_login_time = get_the_author_meta('last_login');
        $allowed_time = 5 * 60; // This will be 5 minutes in seconds
        if (time() > ($last_login_time + $allowed_time)){
            wp_logout();
            wp_redirect( wp_login_url() );
        }
}
}

Please replace the required condition to check the current user, I haven't checked the code but this should do the trick.

This code will not work right after copy-paste you will need to specify the condition to check.

The above code will logout the user after 5 minutes of logging in.

Answer 2

What you are trying to do is not very secure. You have to remember that there is no such thing as logged-in session on the internet, and authentication has to be done with every http request being send. The authentication cookie, while not carrying the password itself in simple plain text, can be used whenever anyone wants to "login" to your site, even after your expiration time.

I haven't looked yet at the session management introduced at 4.1 but I fail to see how it can overcome that basic reality.

The only way to achieve what you want is to change the password for that user. What you are trying to do might work with non tech savvy people, but if this is something that it is important for your business then you need to be aware it is not a secure approach.