1

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the WordPress-auth module for Node.js, I've found that it's not working.

After some search, I've found from WordPress 4.0 for some reason :

  • Now, if the logged_in cookie name is still hashed with MD5, hashed salted password is now sha256 (or sha1 if impossible) encrypted, considering this part of code in WordPress function wp_generate_auth_cookie() :

    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
    $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
    
  • I'm not sure but as i found in the code, since WordPress 4.0, the logged in salt isn't used anymore, but there is usage of token defined in WP_Session_Tokens, as below :

    $manager = WP_Session_Tokens::get_instance( $user_id );
    $token   = $manager->create( $expiration );
    

So i want to know : is there a way from wordpress 4.0 to verify logged_in cookie ?

1 Answer 1

1

Ok i've found the solution.

In fact, as i haven't noticed, there is always the hashed mdp, but for now, the logged_in cookie is structured like this :

%login%|%timeout%|%sessionId%|%passhached%

instead of :

%login%|%timeout%|%passhached%

This is like this since wordpress 4.0, and the wp_session_cookie integration, the auth method is the same that before but there is just 2 change :

  • the sessionid is introduced in the cookie and the key calculation
  • the logged_in cookie encryption is sha256 or if not possible sha1

So there is a scheme of the encryption process

KEY = md5_HMAC(%login%|%caracter 8-12 of the passhached in database%|%timeout%|%sessionId% , LOGGED_IN_KEY.LOGGED_IN_SALT);

RESULT = sha256_HMAC(%login%|%timeout%|%sessionId% , KEY);
// RESULT = sha1_HMAC(%login%|%timeout%|%sessionId% , KEY); only if sha256 is not supported

And for now, to approve a connexion, the logged_in_cookie's pass hached need to be same as RESULT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.