All Questions
Tagged with authentication cookies
36 questions
1
vote
1
answer
222
views
Rest Api Wordpress
I wrote little plugin and I tried to use Rest Api of Wordpress for to communicate admin page to my rest. My problem is : failed rest_cookie_invalid_nonce, return 403 always.
My ajax call :
const ...
- 31
0
votes
1
answer
355
views
Multiple issues with Ajax login function due to browsers and cookies
Using basic usage of ajax login wordpress, no cookie wordpress_logged_in_ are created on safari and Chrome and firefox doesn't read user when cookie "wordpress_logged_in".
I have several ...
- 105
2
votes
0
answers
646
views
Log in user using Wordpress REST API
I am having problems authenticating a user after logging in using a custom endpoint using the WordPress REST API.
I'm aware that this is not the perfect approach but I am just trying to make a few ...
- 163
0
votes
0
answers
75
views
How to verify which WordPress user requested the API in ASP .NET Core?
I have a use-case where I have a WordPress site and an ASP .NET Core as a Restful API backend. I use the WordPress site entire for Frontend, CMS, and User Authentication.
On certain pages of my ...
0
votes
0
answers
228
views
Change auth_cookie_expiration for specific roles and specific login times
In my db i have a login counter that keeps a number value as a record (1,2,3,4,5...)every time a user from a specific role logins.
I am trying to change the auth_cookie_expiration to 1 day for ...
- 35
1
vote
0
answers
808
views
How to save generated JWT token to cookies on login?
I'm developing a Chrome extension and I want my users to authenticate via my WP login page.
I configured JWT Authentication for WP Rest API.
I want the users to go to my website, login, and then have ...
- 111
0
votes
0
answers
344
views
Authentication between two different sites using the WordPress login cookie
Two different WordPress, two different users, same account and password.
In this case, if the user wants to go to (A -> B) the B site after logging in to the A site, the session HASH is already ...
- 3
2
votes
1
answer
246
views
SSO autologin Wordpress + Ajax
That one keeps me awake at night.
The problem is that the user is properly logging in, but AFTER page refresh and should be immediately logged in without page reload. Need a fresh eyes to look at it.
...
- 25
0
votes
0
answers
135
views
Use WP cookie to authentificate user on an external app
Is it possible to authentificate a logged in WP user by it's wp auth cookie from an external app (simple JS webapp on a different domain)?
The setup is:
My webapp is on domain.com/generator/
The ...
- 1
0
votes
1
answer
280
views
Can I "protect" a page with a form asking for an email address?
I am developing a viewing room for an art gallery. Viewing rooms are pages with content that can only be seen by visitors if they provide their email address to add them to a newsletter. Something ...
- 2,002
3
votes
1
answer
2k
views
How to build a plugin that supports authenticated POST requests to the REST API from external servers?
One of the main purposes of an API is to allow the integration of different services/systems.
Let's consider that the WordPress REST API can have both public and protected endpoints, where public ...
- 2,318
2
votes
1
answer
3k
views
Can't GET draft posts via REST API from headless frontend
I have a headless install of Wordpress on v5.4.0. The frontend can't GET any post that is in draft status, though when accessing the API url directly the data is returned without an issue. I'm ...
- 31
0
votes
0
answers
30
views
The same session information for peer users on two different WordPress servers
The MultiSite feature of WordPress is very nice. But for different WordPress installations on different servers, I need something like this.
When a user logs on site (A), if the same user has a ...
- 1
2
votes
1
answer
3k
views
Rest API authentication issue when called from fetch request in bundle.js
I'm able to use the Rest API for calls that don't need auth, but I'm having an auth issue for the routes that require it. Here is part of a .php view template for an admin page:
<div id="...
- 387
0
votes
0
answers
668
views
Extend Cookie with auth_cookie_expiration not working
I was trying to extend the Login Cookie with the following Code
function expiration_filter($seconds, $user_id, $remember){
//if "remember me" is checked;
if ( $remember ) {
//WP ...
- 1
1
vote
1
answer
58
views
Auth cookie value security risk?
A short question this time:
How much of a security risk is it when an third party gets access to WordPress auth cookie?
Can they for example simply copy the cookie and "be" logged in as the user who ...
- 113
0
votes
1
answer
105
views
is_user_logged_in() returns different values on different pages
On most of my site, is_user_logged_in() works perfectly.
On two pages with similar custom templates set, this incorrectly returns FALSE. The user can navigate back to other pages where it works ...
- 101
0
votes
1
answer
2k
views
Why does Wordpress use cookies for /wp-admin and /wp-content/plugins for non-admin users [duplicate]
After login with Firefox to Wordpress website as non admin user, 3 cookies are set:
wordpress_logged_in_...
wordpress_sec_... for path /wp-admin
wordpress_sec_... for path /wp-content/plugins
Why ...
- 224
2
votes
2
answers
6k
views
Configuring WordPress Auth Cookie Expiration
I'm trying to configure the WordPress cookie expiration time, but for some reason it's not working. I went here:
https://developer.wordpress.org/reference/hooks/auth_cookie_expiration/
And put the ...
- 193
1
vote
0
answers
251
views
Wordpress authentication cookie and ajax calls
I'm up against a challenge.
I got a WordPress website where users sign up to the website using the built-in WordPress user login system. And as you may know, this places a WordPress authentication ...
- 1,879
4
votes
1
answer
4k
views
Should wordpress_logged_in cookie exist while logged out?
I noticed that while logged out on my Wordpress site, my browser is sending this Cookie header with every request (obfuscated for security):
Cookie: wordpress_logged_in_OBFUSCATED=flimm%7COBFUSCATED; ...
- 710
1
vote
2
answers
2k
views
After logout browser's back button into twenty sixteen theme profile
I have tried numerous ways to prevent the browser's back button from allowing someone from using it to go back into a visitors logged out profile. The codes I used were supposed to prevent the browser ...
- 11
1
vote
1
answer
2k
views
Cookie is not set
A member sign-in form is processed in the theme's functions.php with the code below. For a test, when good credentials are entered in the form, the process is stopped with die("I LIKE COOKIE!&...
- 127
0
votes
1
answer
703
views
Detect if authentication is set to "remember" a user being logged on
I am writing a custom frontend logon page for a theme I am working on. The logon page uses wordpress functions as much as possible (eg., wp_signon, wp_set_auth_cookie, ...etc.).
For logging on, I do ...
- 2,204
4
votes
2
answers
3k
views
Keep Users Logged In As Long As I Like
I'm implementing a Kiosk webapp based off WordPress and I have some conditionals which are key, they work based on whether user is logged in or not.
I'm aware that after user clicks "remember me" it ...
- 385
0
votes
1
answer
155
views
Where is function to prevents non logged users access wp-admin?
Where is the function, that prevents non logged users, access restricted pages in Wordpress?
I've looked in several files, but not found. I want to modify the way Wordpress authenticates to check ...
0
votes
0
answers
1k
views
Logged In cookie gets saved but not Auth cookie
I am trying to get WordPress to run on PHP-CGI which I call from my ExpressJS (Node JS) server. After getting some bugs worked out on my end, I finally got the front-end working. I can login and the ...
- 851
0
votes
1
answer
140
views
Opening protected page with cookie?
I'm working on an app that uses WordPress for user management. After login, the app holds the auth cookie. How can I use that cookie to open a web view of a protected page within the app without ...
- 101
2
votes
1
answer
3k
views
How does the "authentication unique keys and salts" feature work?
I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, ...
- 333
3
votes
1
answer
408
views
Security error WP 4.0 + WP phpBB Bridge [closed]
so today I updated to 4.0 (glad I had backup).
Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under appearance->...
- 163
0
votes
1
answer
2k
views
How to set a cookie for logged in users to md5($user->ID . "my_secret")?
For all logged in visitors of my WordPress website I would like to set 2 cookies based on their user ID - so that I can use their user IDs in WordPress-unrelated PHP scripts at the same domain.
In ...
1
vote
1
answer
4k
views
Set authentication cookies to be shorter but then extend with every page load
I'm trying to get around the otherwise very insecure way of Wordpress handling authentication cookies. I mean, having the cookie expire in 2 weeks only if I build a membership site is obviously not ok,...
- 119
8
votes
2
answers
10k
views
why does WordPress need two cookies for auth/login
I can see two cookies: auth and login cookies in wordpress. Why do we need two?
I think one is enough.
- 285
3
votes
1
answer
543
views
Authentication/API Questions
We are trying to use S2Member to manage our WP site and memberships for a Flash program that we are launching. We'd like to use S2Member to authenticate the user when they login and remain logged in.
...
- 31
10
votes
5
answers
17k
views
How to validate a user from ouside wordpress/php?
I'm working on an ajax application that will be embedded in a wordpress page. The ajax app exchanges data with servlets running on tomcat. Now the servlets need a way to determine if a request comes ...
- 195
3
votes
1
answer
4k
views
How to transition cookies from .subdomain.domain.com to .domain.com with minimal impact on users?
I need to extend the cookies of a subdomain.domain.com to all of the domain.com's subdomains (.domain.com in cookie terms).
I am trying to minimize the impact of this transition. It seems that ...
- 1,761