1

I'm adding a modal login to my theme.

The most direct route is to create a template and include wp_login_form(); in it. This will load the core login that can be customized a bit later, using CSS or jQuery.

However it requires the page to reload to verify the credentials. My thought was to send the username and the hashed password using an AJAX request, and sign the user in via wp_singon().

Now my questions are:

  1. Is it safe to do this? WordPress itself sends the password to server in some way, but I'm not sure this is it.
  2. If it's okay to do this, should I use admin-ajax? or can the REST-API handle the login too?
  3. If all of the above are fine, then one final question. Is wp_signon() the proper function for login? I thought wp_set_auth_cookie() might come in handy too.

Thanks!

Improve this question
5
  • Why do you think that it might be not safe? Or am I misunderstand your question? The method what you going to follow is very common in web apps. – Ranuka Jun 24 '17 at 16:17
  • @Ranuka In case it's on a non-secure connection (HTTP) and the hash is compromised. Is it strong enough to survive a bruteforce attack? – Jack Johansson♦ Jun 24 '17 at 16:18
  • Stating the obvious, get yourself an SSL certificate and force https. This is the only true secure method. – TheDeadMedic Jun 24 '17 at 17:08
  • @TheDeadMedic Unfortunately that's not for me to decide. The customer whom buys the theme should take care of that. – Jack Johansson♦ Jun 24 '17 at 17:16
  • If you think about security, you have to use SSL. Otherwise, what ever method you use all passwords are sent server to as plain text. Because what ever technique you used like hashing, encrypt it all happens inside the server. – Ranuka Jun 24 '17 at 17:24
2

Assuming you do not do stupid things, and use properly the relevant API, an AJAX login form can be as secure as the "core" login form.

The way you transfer the data is not very important by itself. Even HTTP, although people and google will claim as being insecure, can probably be secure enough with 2FA, one time passwords, or just use your own cellular connection instead of coffee shop/work WiFi/network. In any case this is up to the site's owner to decide.

As for point 3, wp_signon is the right one and from there all the authentication and setting of cookies should be done.

One thing to keep in mind when doing AJAX, is that a successful login will not by itself reflect the new status in the UI without some extra work, and the easiest path is probably to just refresh the page which makes the whole AJAX idea much less appealing.

Another obstacle you will face is error reporting, like user/password mismatch, you will need to make a way to transfer the login errors to the front-end and make it in a generic enough way to let other login related plugins to add their own errors.

If it sounds like I am against login via AJAX, I guess I am, but this is just a personal opinion, there is nothing technically impossible or insecure about it.

Improve this answer
3
  • The reason I'm using AJAX is to prevent a reload on each unsuccessful attempt, and also you know, add some fancy stuff to a theme. I will force the page to reload after the login. However I'm not sure I should do this by admin-ajax or REST? – Jack Johansson♦ Jun 24 '17 at 16:46
  • everything you can. should be done via REST, it just better decouples AJAX style operations from the admin directories, so for example you might be able to just block access to them based on IP, The drawback is that you need to be careful and send the relevant header for google to not index it (maybe it is already done) and that it limits your theme to versions 4.4+ – Mark Kaplun Jun 24 '17 at 17:18
  • I am also little bit against login via AJAX and It takes 3,4 times developer time than normal login. And many popular sites like Facebook, Google also used normal login instead of Ajax login. – Ranuka Jun 24 '17 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.