1

I've read all the relevant question here on StackExchange and I haven't found a solution. Here's the problem: I use a plugin to use Google OAUTH to login in Wordpress. All working correctly, but I can't set the "remember me" option to true because the OAUTH login doesn't use this option. So, the login cookie can't survive the browser session, and I must login again everytime the browser's close.

So, I've found that the WP Core function wp_signon (in wp-includes/user.php) assume that "remember me" is false by default; so I've tried to invert the logic directly in core, inverting true with false and viceversa;

if ( ! empty( $credentials['remember'] ) ) {
        $credentials['remember'] = false;
    } else {
        $credentials['remember'] = true;
    }

doing so, i can login using OAUTH and the login cookie survives the browser session for 14 days. Now, what's the correct way to permanently enable this behaviour? On the next update the Wp Core files will be overwritten...

Thanks for any advice.

4
  • Yes, you should never edit core WordPress files! And there are filter hooks you could use, but, "the OAUTH login doesn't use this option" - how did you confirm that, and have you checked the plugin's documentation and/or source code, in case there's actually an option or a hook for setting the 'remember me' to true, or for setting the cookie expiration to a specific number of days? Also, do you know how the plugin outputs the login form, or does it use the default login form (at wp-login.php), or does the plugin use the wp_login_form() function?
    – Sally CJ
    Jun 11, 2022 at 0:34
  • Thanks for the reply. I'm using this plugin for OAUTH login it.wordpress.org/plugins/login-with-google . I've checked how it's doing the authentication, trying to add the "remember me" in the login phase but without success. For example in the authentication.php i've found that code: public function set_auth_cookies( WP_User $user ) { wp_clear_auth_cookie(); wp_set_current_user( $user->ID, $user->user_login ); // wp_set_auth_cookie( $user->ID ); // original code wp_set_auth_cookie( $user->ID, 1, is_ssl() ); // modified by me } but not luck. Jun 11, 2022 at 9:44
  • "wp_set_auth_cookie( $user->ID, 1, is_ssl() ); // modified by me" - I'm not sure why that didn't work for you - perhaps another plugin is modifying the 'remember me' or the cookie expiration. But anyway, you could actually use/try the auth_cookie_expiration filter to modify the cookie expiration.. i.e. without overriding the wp_set_auth_cookie() function..
    – Sally CJ
    Jun 11, 2022 at 14:49
  • I've tried without any plugin, every time with no success. Extending the lifespan of the cookie doesn't change the fact that is created with "session" property, so at every browser restart, the cookies is deleted. All the problem is around the fact that the login via OAUTH bypasses the "remember me" and the wp_signon function, i think. Anyway, the override proposed in the answer by the DeadMedic work flawlessly. :) Jun 11, 2022 at 21:49

1 Answer 1

1

Without knowing what Google OAuth plugin you're using (and how it internally signs a user in), the only way is to override the pluggable function wp_set_auth_cookie, setting $remember to always true:

if ( ! function_exists( 'wp_set_auth_cookie' ) ) :
    /**
     * Sets the authentication cookies based on user ID.
     *
     * The $remember parameter increases the time that the cookie will be kept. The
     * default the cookie is kept without remembering is two days. When $remember is
     * set, the cookies will be kept for 14 days or two weeks.
     *
     * @since 2.5.0
     * @since 4.3.0 Added the `$token` parameter.
     *
     * @param int         $user_id  User ID.
     * @param bool        $remember Whether to remember the user.
     * @param bool|string $secure   Whether the auth cookie should only be sent over HTTPS. Default is an empty
     *                              string which means the value of `is_ssl()` will be used.
     * @param string      $token    Optional. User's session token to use for this cookie.
     */
    function wp_set_auth_cookie( $user_id, $remember = false, $secure = '', $token = '' ) {

        /**
         * Force $remember 
         */
        $remember = true;

        if ( $remember ) {
            /**
             * Filters the duration of the authentication cookie expiration period.
             *
             * @since 2.8.0
             *
             * @param int  $length   Duration of the expiration period in seconds.
             * @param int  $user_id  User ID.
             * @param bool $remember Whether to remember the user login. Default false.
             */
            $expiration = time() + apply_filters( 'auth_cookie_expiration', 14 * DAY_IN_SECONDS, $user_id, $remember );

            /*
             * Ensure the browser will continue to send the cookie after the expiration time is reached.
             * Needed for the login grace period in wp_validate_auth_cookie().
             */
            $expire = $expiration + ( 12 * HOUR_IN_SECONDS );
        } else {
            /** This filter is documented in wp-includes/pluggable.php */
            $expiration = time() + apply_filters( 'auth_cookie_expiration', 2 * DAY_IN_SECONDS, $user_id, $remember );
            $expire     = 0;
        }

        if ( '' === $secure ) {
            $secure = is_ssl();
        }

        // Front-end cookie is secure when the auth cookie is secure and the site's home URL uses HTTPS.
        $secure_logged_in_cookie = $secure && 'https' === parse_url( get_option( 'home' ), PHP_URL_SCHEME );

        /**
         * Filters whether the auth cookie should only be sent over HTTPS.
         *
         * @since 3.1.0
         *
         * @param bool $secure  Whether the cookie should only be sent over HTTPS.
         * @param int  $user_id User ID.
         */
        $secure = apply_filters( 'secure_auth_cookie', $secure, $user_id );

        /**
         * Filters whether the logged in cookie should only be sent over HTTPS.
         *
         * @since 3.1.0
         *
         * @param bool $secure_logged_in_cookie Whether the logged in cookie should only be sent over HTTPS.
         * @param int  $user_id                 User ID.
         * @param bool $secure                  Whether the auth cookie should only be sent over HTTPS.
         */
        $secure_logged_in_cookie = apply_filters( 'secure_logged_in_cookie', $secure_logged_in_cookie, $user_id, $secure );

        if ( $secure ) {
            $auth_cookie_name = SECURE_AUTH_COOKIE;
            $scheme           = 'secure_auth';
        } else {
            $auth_cookie_name = AUTH_COOKIE;
            $scheme           = 'auth';
        }

        if ( '' === $token ) {
            $manager = WP_Session_Tokens::get_instance( $user_id );
            $token   = $manager->create( $expiration );
        }

        $auth_cookie      = wp_generate_auth_cookie( $user_id, $expiration, $scheme, $token );
        $logged_in_cookie = wp_generate_auth_cookie( $user_id, $expiration, 'logged_in', $token );

        /**
         * Fires immediately before the authentication cookie is set.
         *
         * @since 2.5.0
         * @since 4.9.0 The `$token` parameter was added.
         *
         * @param string $auth_cookie Authentication cookie value.
         * @param int    $expire      The time the login grace period expires as a UNIX timestamp.
         *                            Default is 12 hours past the cookie's expiration time.
         * @param int    $expiration  The time when the authentication cookie expires as a UNIX timestamp.
         *                            Default is 14 days from now.
         * @param int    $user_id     User ID.
         * @param string $scheme      Authentication scheme. Values include 'auth' or 'secure_auth'.
         * @param string $token       User's session token to use for this cookie.
         */
        do_action( 'set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme, $token );

        /**
         * Fires immediately before the logged-in authentication cookie is set.
         *
         * @since 2.6.0
         * @since 4.9.0 The `$token` parameter was added.
         *
         * @param string $logged_in_cookie The logged-in cookie value.
         * @param int    $expire           The time the login grace period expires as a UNIX timestamp.
         *                                 Default is 12 hours past the cookie's expiration time.
         * @param int    $expiration       The time when the logged-in authentication cookie expires as a UNIX timestamp.
         *                                 Default is 14 days from now.
         * @param int    $user_id          User ID.
         * @param string $scheme           Authentication scheme. Default 'logged_in'.
         * @param string $token            User's session token to use for this cookie.
         */
        do_action( 'set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in', $token );

        /**
         * Allows preventing auth cookies from actually being sent to the client.
         *
         * @since 4.7.4
         *
         * @param bool $send Whether to send auth cookies to the client.
         */
        if ( ! apply_filters( 'send_auth_cookies', true ) ) {
            return;
        }

        setcookie( $auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure, true );
        setcookie( $auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure, true );
        setcookie( LOGGED_IN_COOKIE, $logged_in_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, $secure_logged_in_cookie, true );
        if ( COOKIEPATH != SITECOOKIEPATH ) {
            setcookie( LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure_logged_in_cookie, true );
        }
    }
endif;

I'd recommend putting this in a MU plugin, for example wp-content/mu-plugins/always-remember.php

2
  • Very thanks! I'm going to check if it's working! Jun 11, 2022 at 9:39
  • Perfect! Working as expected. I didn't think of a mu-plugin to override that funtion... my bad. I've just added a starting "<?php" and a basic security code "defined( 'ABSPATH' ) or die(); " Jun 11, 2022 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.