I have an ASP .Net MVC site and I would like users who are logged in to my site to be able to access a separate WordPress site which I also own. Otherwise, if a user is not logged into my ASP .Net site, the WordPress site should remain private.

What is the easiest way to implement this? I thought about SSO but it seems like overkill for this simple scenario. I don't need users identified on the WordPress site; they won't be allowed to post or anything, all they can do is just read my posts there.

up vote 0 down vote accepted

I ended up making the whole WP site private except to logged in users by using a plugin (Ultimate Member). Then I created a single login which would be used from the .Net site. The way it works is:

  1. User clicks on link within .Net site to access WordPress site
  2. Server-side: performs POST to /wp-login.php with credentials for single WP user
  3. Server-side: retrieve cookies from wp-login.php response
  4. Client-side: call to custom PHP page on WP site: /setcookies.php and set user’s session cookies for WP site domain using cookies from previous step
  5. Client-side: open WP site in iframe using session cookies
  • 1
    You have basically done an "primitive" SSO. This would be enough if all you want to do is to make sure only your friends can get access, but this is going to fail if you are trying to hide any content which is worth hacking attempt. One weak point of several in this scheme is that if you are using one specific user to login, you have no ability to deny people access after they gained one. – Mark Kaplun Jul 10 at 3:52
  • @MarkKaplun couldn't I just change the WP salts and thereby invalidate all existing session tokens? Also, I could set shorter session lifetimes and force users to have to re-login. They would never actually have the user credentials to my WP. – blizz Jul 11 at 4:09
  • Changing the salts is an interesting idea, the problem is that you might end up doing it while someone had just logged in. Maybe once every week, might be good. Session length is basically the cookie expiry time, and therefor can be fully control by the user, which means it will not protect you against hacking. In the end of the day it all depends what is it that you are protecting, and the more worthy it is, the more incentive you should have to implement a proper SSO. – Mark Kaplun Jul 12 at 4:03

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.