WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent explanation, but it concerns the 3.9 version, so it's a little bit outdated.
I compared the sources of the current WordPress code and from the examples in the article, and there's one thing I can't understand.
The cookie looked like this:
In that article, the guy said that we can predict
timestamp and also the
hash, so basically the whole cookie string, but only when we didn't implement the unique keys/salts.
The problem is that the cookie was a little bit different from the one we use now -- it didn't have the
Does anyone know what the token was introduced for, and whether it's predictable? What's the purpose of it because we have the unique keys/salts, isn't it?