WordPress Auto Login From Email Link

Question

I am creating a membership site where I am trying to login a particular user from a link sent to their email address.

I have a custom post typed called "Members", where I have stored a unique key with the name "user_key". After a particular process, the email is sent to that user with an auto login link.

An example link looks like the following

http://example.com/process/?key=DcP2K7cmBUrLVRjizs78RAuuoMGRFc6F6TMDm6E6

Process is the page which handles the login part. Here is the code used in that page.

get_header();

$key = $_GET['key'];
$args = array(
    'post_type' => 'member',
    'meta_value' => $key
);

$properties = new WP_Query($args);

if($properties->have_posts()) : 
    while($properties->have_posts()) : $properties->the_post();
        $author = $post->post_author;

        $user = get_user_by('ID', $author);
        $user_id = $user->ID;

        echo $user_id;

        wp_set_current_user($user_id, $loginusername);
        wp_set_auth_cookie($user_id);
        do_action('wp_login', $loginusername);

        wp_redirect( home_url() );
    endwhile;
endif;
wp_reset_query();

get_footer();

When I go to that particular link, I get the following error.

"Warning: Cannot modify header information - headers already sent"

From what I understand, I think it's the "wp_set_auth_cookie" part which is done after the headers are loaded, which is creating that problem.

Anyone has any ideas how to fix it?

Answer 1

You can't send headers after there is already some output. If you wish to add content to display if the redirect fails, put the header and footer in the relevant code block:

//login code
//if redirect happens, code execution halts, so there is no need for an if else

get_header();
//error message
get_footer();

Answer 2

A better approach will be having the user_id in the URL (maybe not even a plain text $code = get_user_meta( $user_id, 'activation_account_token', true ); and checking the token from user are the same - out of scope for this question).

The reason for the error is this line echo $user_id;

wp_clear_auth_cookie();
wp_set_current_user ( $user->ID );
wp_set_auth_cookie  ( $user->ID );
wp_redirect( home_url() );

You shouldn't output anything before the redirect takes place.

Updated

You have a few option on how you can handle the redirect:

Inside the theme template moving the redirect code above the get_header();

function.php /plugin

A better option will be using the wp_loaded that is triggered before any HTML will be output.

add_action ('wp_loaded', 'login_redirect');
    function login_redirect() {
        if ( isset( $_GET['key'] ) ) {
            $user = get_users(array(
                'meta_key'     => 'key_or_the_name_you_use',
                'meta_value'     => $_GET['key'] ,
                'number' => 1,
            ));
            if(count($user) == 1){
                $user_id =$user[0]->ID;
                wp_clear_auth_cookie();
                wp_set_current_user ( $user_id  );
                wp_set_auth_cookie  ( $user_id );
                wp_redirect( home_url() );
                exit;
            }

        }
    }

This is What you can actually do but I think you misread my answer as including the user id can increase the security not decrease it.

Including the user_id can bind the user id with the token so someone brute forcing URLs to make them login will also have to match the random string with the user id account (this is what actually the industry does) - with more, of course, security checks.

Javascript

echo "<script>location.href='get_home_url()'</script>";

This can be output in the position of the wp_redirect to make the browser make the redirect.

But as this is a browser redirect user may have blocked the execution of Javascript or the redirects.