WordPress 4.0 Cookie Authentication to avoid nonce error when publishing a post and page

Question

Cookies are now tied to internal sessions in WordPress 4.0.

This means plugins using basic cookie authentication will have trouble because a token is required for publishing a post or page (as well as update a plugin or core). I've seen this reported for three different bridge plugins.

The old method (used in numerous plugins) was to use wp_set_auth_cookie($user_id,0,0) but this will no longer work. The user is logged into the site but the user with the correct roles cannot publish a post or page. Instead an nonce error is returned ("Are you sure you want to do this?)

This is the new code (among many other attempts) I've tried but still get the same nonce error.

wp_set_auth_cookie( $user_id, 0, 0 );
$manager = WP_Session_Tokens::get_instance( $user_id );
$token = $manager->create( $expiration );

To overcome this issue, and temporarily, the wp_verify_nonce is set to always return 1. However, I'd like to know how to create the token upon the set of the cookie.

Has anyone overcome this issue yet? Since this is all new code for WP, does anyone have any suggestions?

UPDATE: After spending a few hours this evening looking at this problem again ... I realized that a Zend_Debug::dump($_COOKIE); might be helpful. Sure enough the string in two cookies do not match.

The string for these two don't match in the hmac.

'wordpress_logged_in_4ed466320671a355e05b9bf211271dd6'

'wordpress_4ed466320671a355e05b9bf211271dd6'

Interestingly, if I do a Zend_Debug::dump($cookie_elements['hmac']); the string returned matches the wordpress_4.... value and not the wordpress_logged_in.

The mismatch leads to a nonce error.

Answer 1

Actually, just doing this check fixed this issue.

if(!is_user_logged_in())
{
    wp_set_current_user($userid);
    if(wp_validate_auth_cookie()==FALSE)
    {
        wp_set_auth_cookie($userid, true, false);  
    }                            
}   

seems to have fixed this issue.

@here,your proposed solution didn't work for me and just redirected me to login page when trying to get into dashboard

Answer 2

Revised: After adding an early test to avoid trying to re-login an already-logged-in user, I was able to remove all session and cookie handling entirely and rely on a single call to wp_set_current_user

Good luck!

---

This solves the problem for me so far and uses the new WP_Session_Tokens class to update the current user's session and token.

Prior code left inline, but commented out.

Thanks for the pointers @LPH, much appreciated.

$username = 'username';

// Edge case handles when plugin is activated and still logged in as old user.
// wp_clear_auth_cookie();

// Setup new user.
$user = wp_set_current_user($user_id, $username);

// wp_set_auth_cookie($user_id, 1);

// Required for WP 4.0
// https://core.trac.wordpress.org/ticket/20276
// $sessionManager = WP_Session_Tokens::get_instance( $user_id );
// $token = $sessionManager->create(time() + (1 * 24 * 60 * 60));
// $session = $sessionManager->get($token);
// $sessionManager->update($token,$session);

Answer 3

The authentication was done by creating a wp_validate_auth_cookie function and calling it.

if ( ! function_exists( 'wp_validate_auth_cookie' ) ) :

function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) {

    if ( XenWord::getVisitor()->getUserId() != 0 ) {
        return XenWord::getVisitor()->getUserId();
    }

    return false;
}

endif;

Then call this replacement in the login portion of your code.

    $current_user = get_userdata( $user_id );

    wp_set_current_user( $user_id );

    wp_validate_auth_cookie($cookie = '', $scheme = '');

    // Check to determine if adding XF users to WP database
    XenWord_XF_Users::check_options();

    return $current_user;

Caching plugins now work again.