Wordpress authentication using custom php?

Question

i need to integrate a wordpress login into my php website, for the purpose of single login to access my website and wordpress blog also, i have used some codes using curl it is logged in the user, and there after it redirects into my home page , after i have to access my wordpress blog it doesn't authenticate me, it say me to login,

am using following code

$username="admin";
$password="blog";
$url="http://wordpressblogURL/";
$cookie="cookie.txt";

$postdata = "log=". $username ."&pwd=". $password ."&wp-submit=Log%20In&redirect_to=". $url ."blog/wordpress/wp-admin/&testcookie=1";
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, $url . "blog/wordpress/wp-login.php");

curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6");
curl_setopt ($ch, CURLOPT_TIMEOUT, 60);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 0);
curl_setopt ($ch, CURLOPT_COOKIEJAR, $cookie);
curl_setopt ($ch, CURLOPT_REFERER, $url . "blog/wordpress/wp-login.php");

curl_setopt ($ch, CURLOPT_POSTFIELDS, $postdata);
curl_setopt ($ch, CURLOPT_POST, 1);
$result = curl_exec ($ch);
curl_close($ch);
echo $result;

exit;

please let me know what is wrong with this code, also in cookie.txt something written every time am login into my website

Thanks in advance

Answer 1

Wordpress uses cookie based authentication. When you log into wordpress using curl, wordpress is authenticating the server(which ran the curl script) & not your client. so when you visit wordpress using your browser(client), it's not authenticated.

For the solution, you could use wordpress hooks to automatically authenticate the user to your site just after they authenticate themselves to wordpress. Then whenever a user comes to your site, you could just redirect them to wordpress login url for authentication.

Another solution is to override the authentication functions in wordpress. All of the authentication functions in wordpress are directly or indirectly pluggable. When you override them instead of checking if the user has the correct cookie set, you will check if the user has logged in on the other site (Maybe use a shared database?)