Change default login auth

Question

I am going to enhance my WordPress authentication page. My idea is simply, is just change the process to check password, like the default process login with username or email.

I've change the database adding the extra field "code":

My objective is: the user can login with your username or email and with your password or code.

However, I don't know which part of coding is used to verify the password as I want to refer to the existing coding.

Answer 1

You can hook into this filter - https://developer.wordpress.org/reference/hooks/check_password/ - and validate if the user submitted password is the same as the user's custom code field value return true.

Example:

add_filter( 'check_password', function( $check, $password, $hash, $user_id ) {

    // Run additional checks if current check is false
    if ( ! $check ) {

        // Check that password matches custom field and if so return true
        if ( $password && $password = get_user_meta( $user_id, 'CUSTOM_CODE_FIELD_ID', true ) ) {
            $check = true;
        }

    }

    // Return check value
    return $check;

}, PHP_INT_MAX, 4 );

Now...this is just a simple example of the code you may use. But you would likely want to secure the "code" better using some sort of encryption. WordPress stores passwords as md5 hash values but it's not as secure as other methods such as bcrypt.