I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the WordPress-auth module for Node.js, I've found that it's not working.
After some search, I've found from WordPress 4.0 for some reason :
Now, if the logged_in cookie name is still hashed with MD5, hashed salted password is now sha256 (or sha1 if impossible) encrypted, considering this part of code in WordPress function
// If ext/hash is not present, compat.php's hash_hmac() does not support sha256. $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1'; $hash = hash_hmac( $algo, $user->user_login . '|' . $expiration . '|' . $token, $key );
I'm not sure but as i found in the code, since WordPress 4.0, the logged in salt isn't used anymore, but there is usage of token defined in WP_Session_Tokens, as below :
$manager = WP_Session_Tokens::get_instance( $user_id ); $token = $manager->create( $expiration );
So i want to know : is there a way from wordpress 4.0 to verify logged_in cookie ?