1

I'm trying to do a sort of SSO/programmatic login solution for our wordpress site from our separate web application. I don't have a lot of experience with wordpress so I assume there's something I'm missing or have configured incorrectly.

First here is my testing code that works great when I hit it directly IE www.mywordpresssite.com/test_login.php

test_login.php:

<?php
require __DIR__ . '/wp-load.php';

$username = 'myuserid';

$user = get_user_by('login', $username);

if (!is_wp_error( $user )) {
  wp_clear_auth_cookie();
  wp_set_current_user($user->ID);
  wp_set_auth_cookie($user->ID, TRUE);
  $redirect_to = user_admin_url();
  wp_safe_redirect( $redirect_to );
}

exit();

The above sets the cookies accordingly and logs in the 'myuserid' user no problem. It redirects to user_admin_url() which was fine for my test but unnecessary as my intention is just to go to the home page as the entire site will be locked down for non-logged in users once this is working accordingly.

Now using the same concept that worked in test_login.php I've created prod_login.php which is supposed to apply the same logic via a cURL request from the web application that passes creds via the Authentication header.

prod_login.php:

<?php
require __DIR__ . '/wp-load.php';

$response = array('http_code' => 500, 'message' => 'Failed to update response');

if ($_SERVER['PHP_AUTH_PW'] !== 'password123') {
  $response['http_code'] = 401;
  $response['message'] = 'Unauthorized login attempt';
  echo json_encode($response);
  die();
}

$username = $_SERVER['PHP_AUTH_USER'];
$user = get_user_by('login', $username);

// Redirect URL //
if (!is_wp_error( $user )) {
  wp_clear_auth_cookie();
  wp_set_current_user($user->ID);
  wp_set_auth_cookie($user->ID, TRUE);
  //$redirect_to = user_admin_url();
  //wp_safe_redirect( $redirect_to ); //commented out as unnecessary
  $response['http_code'] = 200;
  $response['message'] = 'Login Successful';
  $response['user'] = $user;
  echo json_encode($response);
} else {
  $response['http_code'] = 403;
  $response['message'] = 'Invalid User';
  echo json_encode($response);
}

exit();

Now my cURL request appears to be working fine, I'm consistently getting the http_code === 200 response and the user object is coming back correctly in the cURL response. However, after the redirect to the wordpress site from the web app, the cookies are not set and I am not actually logged in.

web app cURL request:

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_USERPWD, 'myuserid' . ':' . 'password123');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type:application/json'));
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_URL,'http://mywordpresssite.com/prod_login.php');
    $server_output = curl_exec($ch);
    if (curl_errno($ch)) {
        // handle failed cURL
    }
    $decoded_response = json_decode($server_output);

    if ($decoded_response->http_code === 200) {
        // cURL response indicated successful login
        // I can consistently get to this point and it will do the redirect but I will not be logged in nor will the cookies be set
        header('Location: mywordpresssite.com'); // go to the wp homepage now that we should be logged in
    }

I have no idea what I'm doing wrong. I assume it has to do with the cookies getting blown away or not preserved between the cURL and the redirect. Any insight on how to prevent that from happening or what I'm doing incorrectly is appreciated. Is this even possible with a cURL?

I have also tried a multitude of the examples of add_filter(‘auth_cookie_expiration’,... and apply_filters(‘auth_cookie_expiration’,... that are available on the internet to no avail.

0

From what I can tell, what I was trying to do is not possible.

The cURL request never actually touches the browser, it goes from the web app server to the wordpress site server so there in that context the web app server is the client. So when the redirect happens, the cookie is not set in the browser.

What I've done instead is a GET request passing my tokenized values in the query string. It's not as secure this way as anyone who gets their hands on the token will technically be able to access the site and login but there doesn't appear to be a way around that. At least the tokenized URL is never actually visible in the address bar so the typical user will not know what's happening.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.