Is it safe to manually sign a user in using AJAX?

Question

I'm adding a modal login to my theme.

The most direct route is to create a template and include wp_login_form(); in it. This will load the core login that can be customized a bit later, using CSS or jQuery.

However it requires the page to reload to verify the credentials. My thought was to send the username and the hashed password using an AJAX request, and sign the user in via wp_singon().

Now my questions are:

1. Is it safe to do this? WordPress itself sends the password to server in some way, but I'm not sure this is it.
2. If it's okay to do this, should I use admin-ajax? or can the REST-API handle the login too?
3. If all of the above are fine, then one final question. Is wp_signon() the proper function for login? I thought wp_set_auth_cookie() might come in handy too.

Thanks!

Answer 1

Assuming you do not do stupid things, and use properly the relevant API, an AJAX login form can be as secure as the "core" login form.

The way you transfer the data is not very important by itself. Even HTTP, although people and google will claim as being insecure, can probably be secure enough with 2FA, one time passwords, or just use your own cellular connection instead of coffee shop/work WiFi/network. In any case this is up to the site's owner to decide.

As for point 3, wp_signon is the right one and from there all the authentication and setting of cookies should be done.

One thing to keep in mind when doing AJAX, is that a successful login will not by itself reflect the new status in the UI without some extra work, and the easiest path is probably to just refresh the page which makes the whole AJAX idea much less appealing.

Another obstacle you will face is error reporting, like user/password mismatch, you will need to make a way to transfer the login errors to the front-end and make it in a generic enough way to let other login related plugins to add their own errors.

If it sounds like I am against login via AJAX, I guess I am, but this is just a personal opinion, there is nothing technically impossible or insecure about it.