Here is part of a multisite plugin I wrote that forces a user to log in. It required a user to be registered for the site; not just be a network user. It could be modified to check if user has a higher role. I did modify it to fit the OP requirements. add_action( ‘init’, … Read more
wp_authenticate() just checks user data, but not actually authenticating – docs. You can use wp_signon, which uses and wp_authenticate: source, like this: $credentials = [ ‘user_login’ => $name, ‘user_password’ => $password, ‘rememberme’ => true, ]; $signon = wp_signon($credentials, true); // true – use HTTP only cookie if(is_wp_error($signon)){ return false; } // The user is logged … Read more
get_current_user_id() effectively does what @Giri had described in the first snippet. The internal WordPress function-call chain eventually calls get_currentuserinfo() which already checks if there is a WP_User object, meaning a user is logged in. Thus, from what I can see in the linked code, get_current_user_id() always returns the ID of the user that is logged … Read more
Do not set header in a template file. Those are part of the HTTP request itself. About your problem: Add a template (whatever file you need – see “Template Hierarchy”). On top of it you include the default stuff like get_header(); and so on. For the restricted part, you use the following: if ( current_user_can( … Read more
The answer is most likely XML-RPC which is used to communicate with the mobile wordpress apps and is always on in newer versions. If you don’t use mobile apps to admin your WP you can use my plugin – http://wordpress.org/plugins/control-xml-rpc-publishing/ to disable it.
Basically, they’re hashing salts. They’re used to make the results of hashing much less predictable. See https://en.wikipedia.org/wiki/Salt_(cryptography) for info on salts. AUTH is used for the /wp-admin authentication cookie, SECURE_AUTH is for the same when using SSL, LOGGED_IN is used for identification to the “front-end” of the site. NONCE is used for the nonces that … Read more
After some fiddling and sparring with @t-todua I found the issue: With the Fetch API fetch call you must manually set to send cookies with a request. After setting the credentials option properly the cookies were sent and the AJAX endpoint recognized the current user. So the JS becomes: var msg = ”; // I’m … Read more
Easiest Way to Authenticate WP Users Using an External DB?
I’m currently working on a plugin to do this on a large scale, since I have multiple sites that I want to sync; but I don’t mind sharing the info with you. I understood [from what you said] that the user’s credentials have already been verified on site2 – so there’s no need to use … Read more
Authenticated request to WP REST API V2 returning 403 error on /users/me [closed]