45

The following code does the job for automatic login, without any password! // Automatic login // $username = "Admin"; $user = get_user_by('login', $username ); // Redirect URL // if ( !is_wp_error( $user ) ) { wp_clear_auth_cookie(); wp_set_current_user ( $user->ID ); wp_set_auth_cookie ( $user->ID ); $redirect_to = user_admin_url();...


32

wp_set_auth_cookie() will log a user in without having to know their password.


16

Cross-site Scripting Issues You cannot transfer WP auth cookies between domains. You also don't want to store plaintext passwords for logging into another WP installation programmatically. So, you'll have to have users log into WordPress, and then access their login status via an API endpoint from the third-party site. This lets WordPress handle all the ...


16

Why JWT authentication I'm building a site that uses Wordpress as the back-end, and a React+Redux app as the front-end, so I'm pulling all the content in the front-end by making requests to the Wordpress API. Some requests (mainly, POST requests) must be authenticated, which is when I came across JWT. What we need To use JWT authentication with Wordpress, ...


13

First of all, I would advise against editing the core files as it will be overwritten when you next update WordPress. Also, you should update WordPress, because it will often include security updates. (It's recently been reported that there has been a spate of attacks on sites using outdated WordPress versions) In order to achieve what you actually want to ...


10

Let's go step by step here. Looks like you're trying to use OAuth just for authentication, but before you can do so you need to get the Access Token which will be used to authenticate when you make your API calls. Because this is using OAuth version 1, in order to obtain the Access Token you must do the following: First, setup an application, make a call ...


9

Just add this at the top of your file: require_once($_SERVER['DOCUMENT_ROOT'].'/wp-blog-header.php'); // If you run multisite, you might nees this to prevent 404 error header('HTTP/1.1 200 OK'); Note that the file must be in the same folder as your theme. Then you can use is_user_logged_in before executing the rest of the script. If use is not logged in, ...


9

The issue was because I wasn't generating and sending a nonce value with the request. In order to generate a nonce value. Localize the value of a wp_create_nonce('wp_rest') function call. wp_localize_script('application', 'api', array( 'root' => esc_url_raw(rest_url()), 'nonce' => wp_create_nonce('wp_rest') )); This will then be accessible to ...


8

I have found another solution here that uses a better approach (at least in my opinion...). No need to set any cookie, it uses the Wordpress API: /** * Programmatically logs a user in * * @param string $username * @return bool True if the login was successful; false if it wasn't */ function programmatic_login( $username ) { if ( ...


8

The variable $interim_login is TRUE when the log-in session of a user expires while she is working in the back end, for example during an auto-save action. In this case a message asking to log in again appears at the bottom of the editor: The same can happen in the theme customizer. The $_REQUEST variable that switches the log-in form to interim is ...


8

This showed up as a notification due to the upvote. Here's how I solved it. The endpoint coded in the app that I am supposed to authenticate with prepares the token. The token has to be in the specified format. It then should be base 64 encoded and hash encrypted. The wp_init handler should be used to handle the POST request sent by the endpoint, to extract ...


7

WordPress already has an API built in via an XMLRPC server. Meaning, you can make an XMLRPC request from your java app and verify a username/password. Unfortunately, there's no way to just authenticate through it as is. That said, it's very easy to roll your own. Just hook into xmlrpc_methods, a filter, and add yours. The array key you add with be the ...


7

This should do it: add_action('plugins_loaded', function(){ wp_set_current_user(0); },0);


7

Easy enough, decided to just do the redirect option. I used the wp_login action hook. You could also probably use this for redirecting your users to ANY page on your website. You can also check user capabilities from the $user Object passed in as a function parameter if you want to send different user levels to different pages. /* Redirect the user logging ...


7

ReAuth=1 is required when your login Cookies are no longer valid, WordPress will force validation for your browser. if ( $force_reauth ) $login_url = add_query_arg('reauth', '1', $login_url); Add reauth=1 flag to login url when auth_redirect() redirects to wp-login.php after the auth cookie fails validation wp-login.php clears cookies and ...


6

There is a function in the user.php of the core files called wp_authenticate_username_password that seems like what you're looking for. If you want to avoid throwing in the $user object (you probably only have the username + password), then just throw null as 1st function argument in: $check = wp_authenticate_username_password( NULL, 'some_username', '#...


6

It finally hit me that javascript would be behind the interim login modal behavior, and that gave me a new direction in my search. I have disabled the new login popups by adding the following to my theme's functions.php file: // Disable login modals introduced in WordPress 3.6 remove_action( 'admin_enqueue_scripts', 'wp_auth_check_load' ); If anyone's ...


6

You can use the wp_loaded hook to push all non-logged-in traffic to the login screen. Note how I've passed $_SERVER['REQUEST_URI'] to wp_login_url() - this is passed as a URL parameter to the login page, and once a user successfully signs in, they'll be redirected back to the URL they were originally trying to visit. function ...


6

GET requests, like listing posts, doesn't need authentication at least you need to get private posts. Your problem is that you are using a route/endpoint that doesn't exist. In WordPress 4.4, WP REST API infrastructure was merged, endpoints didn't; they will be merged in WordPress 4.5 (as WordPress 4.6 it seems endpoints are still don't included in core). ...


5

The wp_ajax_{action} hook only fires for logged in users. For logged-out users the action wp_ajax_nopriv_{action} is triggered on an ajax request - so you need to hook into that as well.


5

This works well for me: clean_user_cache($user->ID); wp_clear_auth_cookie(); wp_set_current_user($user->ID); wp_set_auth_cookie($user->ID, true, false); update_user_caches($user);


5

Your problem is that you call wp_logout_url immediately after wp_set_auth_cookie. wp_set_auth_cookie() does some setcookie() calls. Unfortunately setcookie doesn't make the new value available instantly in the PHP global $_COOKIE. It must be set through a new HTTP Request first. wp_logout_url() (via wp_nonce_url > wp_create_nonce > wp_get_session_token > ...


5

Update: Made a blog post to explain this better :) I was able to do this by WP's authenticate filter inside a new plugin; most of which is guided by this tutorial by Ben Lobaugh. Major points on the plugin: Make an API call function using cURL (you can get guide codes from Postman upon testing if you don't know already). Add filter checking if the response ...


5

I would just hook into determine_current_user filter and check HTTP basic auth data to return the user. Maybe, just maybe, I would allow only specific user to be logged via HTTP auth. That could be done, for example, by setting an user option. The code could look like something like this (tested by OP): add_filter( 'determine_current_user', function( $...


4

"On login, wordpress uses the wordpress_[hash] cookie to store your authentication details. It's use is limited to the admin console area, /wp-admin/ After login, wordpress sets the wordpress_logged_in_[hash] cookie, which indicates when you're logged in, and who you are, for most interface use. Wordpress also sets a few wp-settings-{time}-[UID] cookies. ...


4

To answer my own question, when you use WP_Http, the transport used is selected, in this order, from this array: $request_order = array( 'curl', 'streams', 'fsockopen' ); If your PHP supports curl, WP_Http_Curl is used. Curl doesn't support adding the body array parameters when the method is GET WP_Http_Streams and WP_Http_Fsockopen on the other hand, add ...


4

Your option using WP internals would be to use the HTTP API along with wp schedule event Create a scheduled event, something like: register_activation_hook(__FILE__, 'my_schedule'); add_action('execute_my_url', 'do_this_daily'); function my_schedule() { $timestamp = //some time you want it to run wp_schedule_event($timestamp, 'daily', '...


4

Basically, they're hashing salts. They're used to make the results of hashing much less predictable. See https://en.wikipedia.org/wiki/Salt_(cryptography) for info on salts. AUTH is used for the /wp-admin authentication cookie, SECURE_AUTH is for the same when using SSL, LOGGED_IN is used for identification to the "front-end" of the site. NONCE is used for ...


4

The REST API does not support basic authentication out of the box, you need a plugin. The documentation points to this one, accompanied by this warning: Note that this plugin requires sending your username and password with every request, and should only be used for development and testing i.e. not in a production environment.


3

body argument is used for POST requests and set in headers. For GET request encode request arguments into URL (as in your second snippet).


Only top voted, non community-wiki answers of a minimum length are eligible