0

Actually I'm not against hashing but I'm sending user data from website A to website B for being same username and password. In such scenario when I extract password from website A it is already hashed and when I again use wp_insert_user() at website B for the username and password of website A, the password hashing function again executes and hashed password of website A will become password of website. Is there any solution suggestion for using same password and username on both website without using CUSTOM_USER_TABLE at wp-config file. Example:

  • Password(A): 'Test@123' Stored Password(A) :
  • PasswordHash("TEST@123") in database Password(B):
  • PasswordHash("TEST@123") Stored Password(B) :
  • PasswordHash(PasswordHash("TEST@123")) in database

Is there any solution for having same password on both website. Thanks

2
  • I don't think passwords is the right way here: in any case even if you did have the password on site A in clear how would you post it to site B to login? You could post a signed JWT token or something similar instead that site B can unpack into a valid login with an 'authenticate' or 'determine current user' filter, or use something like oAuth, or maybe even get site A to write a site B cookie via an iframe or similar trick, but I think that's getting harder to do with modern browsers.
    – Rup
    May 1, 2020 at 9:30
  • @Rup Thanks for your interest. I've used custom endpoint api to send data. Now what I only need is any of these three:: #1. Extract password without hashing from A #2. Decrypt password #3. Store password at B without hashing at B May 1, 2020 at 9:41

1 Answer 1

0

Can't comment yet so I'll comment here:

You're not going to be able to decrypt wp passwords easily. They're salted and even if you keep entering the same password, the hashed password in the database is going to be different every time. Your best bet is to do something like this on the site where you want to capture the password:

add_action('wp_authenticate','my_password_grabber');

function my_password_grabber () {
    $userName = $_POST['log'];
    $password = $_POST['pwd'];        
}

You can validate the user by doing:

if (is_email($userName)) {
    $user = wp_authenticate_email_password(NULL, $userName, $password);
} else {
    $user = wp_authenticate_username_password(NULL, $userName, $password);
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.