1

I'm trying to get around the otherwise very insecure way of Wordpress handling authentication cookies. I mean, having the cookie expire in 2 weeks only if I build a membership site is obviously not ok, but at the same time, making it expire in 15 minutes while the user is logged in would be more than annoying.

I have searched and tested extensively, and narrowed down the somewhat complicated code forest around this in Wordpress to the pluggable.php file under the wp-includes folder and found wp_set_auth_cookie function on line 652 (v 3.5.1). Now this does give me the possibility to change the times, however those are, as mentioned above, fixed to the login time, instead of to the user's last activity.

I tried to add this function or the wp_signon function using this one to my header, but it didn't do the trick.

Any plugin or hook or something that you can think of that would help me with this?

Thanks a lot for your help in advance!

EDIT (June 6, 2013):

I tried with following code in the functions.php file of my template, but all it does it that it logs me out when I reload the page, it doesn't actually renew the auth cookies. The issue may be with the arguments ($userinnow, $remember, $secure) which, by the way, I don't need/use, except for $userinnow.

/* Renew cookie at every page load */
function renew_wp_cookie() {

    global $current_user;
    get_currentuserinfo();
    $userinnow = $current_user->user_login;
    if (is_user_logged_in()) {
        wp_set_auth_cookie($userinnow, $remember, $secure);
    }
    else wp_clear_auth_cookie();

}

add_action('init', 'renew_wp_cookie');
  • Maybe it's an idea to use cookies that expire when the browser session closes? That way, the user will not be de-authenticated while signed in to your site, but when they close the browser, they will need to log in again the next time they visit. You can also re-set a 15 minute cookie on every page load. That simply means that if your visitor doesn't take any action for 15 minutes, they are de-authed, but if they browse around, the timer just gets pushed back to 15 minutes again. – Marc Dingena May 31 '13 at 7:11
  • Yes, that's exactly what I'm trying to do (actually both, clear the cookie and session end and extend the cookie time at every page load), I just don't know how to implement that solution in Wordpress. Can you help me with that? – webeno May 31 '13 at 7:24
  • I can't answer the question as asked, but a different solution could be that you take the 2 week cookie set by WordPress for granted, and write your own piece of code that checks for the presence of your custom cookie. You could also re-write wp_set_auth_cookie() in a plugin or functions.php. – Marc Dingena May 31 '13 at 7:32
  • Rewriting wp_set_auth_cookie() would not be an option as that would behave the same way, only changing the cookie when the user logs in, not at every page load. I'll wait and see if anyone else might have a ready made solution to this but thanks for your inputs... – webeno May 31 '13 at 8:18
3

You do not need to rewrite wp_set_auth_cookie(), it allows you to change the expiration time of the cookie:

add_filter( 'auth_cookie_expiration', 'wpse101378_change_expire_time', 3 );
function wpse101378_change_expire_time( $expire, $user_id, $remember ){
    //The $remember variable indicates whether the user has elected
    //to be 'remembered'.
    //By default, if true, WP sets expire to 14 days if false, 2 days

    //$expire is time in seconds

    return 24*60*60;
}

If you want to clear the current cookie, you can use wp_clear_auth_cookie() (see source)

  • Alright, so how would you do to make sure the expiration is extended at every page load? Would you put wp_clear_auth_cookie() and wp_set_auth_cookie() below one another in the header of the template? – webeno Jun 1 '13 at 6:54
  • I would probably use the init hook, and check that the user is logged in and is not on the admin-side (!is_admin() ). – Stephen Harris Jun 6 '13 at 11:31
  • can you maybe help me with how that would look like exactly? I am not very familiar with creating hooks actually. If I could, I would disable the whole auth cookie handling mechanism and replace it with mine, any idea how I could do that? – webeno Jun 6 '13 at 14:19
  • i added a test case above, but it's not working, any thoughts? – webeno Jun 6 '13 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.