1

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps our subscription information there on the WP site. I am wanting to use WP authentication to check for subscription status, and subscription status to gate the primary functionality.

I was expecting to build a login form in my chrome extension and securely authenticate with the username and password via https. I'm not seeing that option anywhere. Maybe I'm blind! Instead, I've found:

  1. OAuth2: This I have (mostly) working but feels clunky because it isn't embedded into my Chrome extension. It pops open a borderless WP login window. =/

  2. Single Sign On: This doesn't help me since I need the user's wordpress identity to assess subscription status.

  3. WP API: My understanding is that this wouldn't authenticate each individual user, but just verify access to an API.
    • Oauth: Per WP, this doesn't seem any different (or better) than OAuth2 which is already working.
    • Application passwords: Per WP, these can't be used to login
    • Basic authentication: Per WP, these are not for use in production.

This question seems identical to mine, but the answer points to the API. Am I missing something in the WP API authentication documentation?

Can someone tell me how best to pursue this? I need knowledge, not code.

Improve this question
5
  • I'm not familiar with chrome extensions at all, but if you want users to be able to just type their username/password within the extension, you could easily extend the REST API with your own handler that authenticates the user manually (as opposed to OAuth/application keys), and then have the extension POST to the endpoint?
    – TheDeadMedic
    Commented Apr 29, 2016 at 9:27
  • @TheDeadMedic Ok, so I would POST the credentials in a REST request to the REST API endpoint, have my handler perform authentication and return a yay or nay in the REST response? And that'd be very reasonably secure?
    – colbybhearn
    Commented Apr 29, 2016 at 14:18
  • Yep and yep (providing you use HTTPS of course)
    – TheDeadMedic
    Commented Apr 29, 2016 at 14:32
  • Thank you! I'll give it a shot and set a reminder to come update this question (or accept your answer if you make it one).
    – colbybhearn
    Commented Apr 29, 2016 at 14:34
  • I had to overcome a logout issue (stackoverflow.com/questions/26080632/…), but I'm sticking with OAuth2 for the time being.
    – colbybhearn
    Commented May 24, 2016 at 3:57

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.