authentication - Read For Learn

Validate Custom Login field

Here’s the full working code, put it in functions.php: add_action(‘login_form’,’my_added_login_field’); function my_added_login_field(){ ?> <label for=”my_extra_field”>I agree to the terms <input type=”checkbox” value=”1″ class=”input” id=”my_extra_field” name=”my_extra_field_name”/></label> <?php } function check_checkbox($user, $password) { if( !isset($_POST[‘my_extra_field_name’]) ) { remove_action(‘authenticate’, ‘wp_authenticate_username_password’, 20); $user = new WP_Error( ‘denied’, __(“ERROR: Please agree to our terms.”) ); } return … Read more

Rest API authentication issue when called from fetch request in bundle.js

The problem is that you’re not using the correct name for the REST API nonce header — the correct name is X-WP-Nonce, but you used X-WP-Header: fetch(‘http://localhost/wptest2/?rest_route=/wp/v2/users/me’, { method : ‘get’, mode : ‘cors’, headers : { ‘Access-Control-Allow-Origin’ : ‘*’, ‘X-WP-Header’ : _wpnonce // here you used the wrong name } }) Reference from the … Read more

Can we access the REST request parameters from within the permission_callback to enforce a 401 by returning false?

I’ve created a reduced test case that demonstrates that what you want to do is achievable: add_action( ‘rest_api_init’, function() { register_rest_route( ‘wpse/343039’, ‘route’, [ ‘methods’ => [ ‘POST’ ], ‘permission_callback’ => function( WP_REST_Request $request ) { if ( ‘1’ == $request->get_param( ‘param’ ) ) { return true; } else { return false; } }, ‘callback’ … Read more

How to login to WordPress site using basic authentication HTTP headers?

I would just hook into determine_current_user filter and check HTTP basic auth data to return the user. Maybe, just maybe, I would allow only specific user to be logged via HTTP auth. That could be done, for example, by setting an user option. The code could look like something like this (tested by OP): add_filter( … Read more

Android authentication

The best way to authenticate an app with the REST API would be to use OAuth. There’s a good section on OAuth Authentication the REST API documentation site. You will need to install the OAuth1 plugin on your site as well. There are some gotchas with implementing the OAuth plugin on WordPress. I found this … Read more

how to update current logged user username

Try hooking in as soon as the user is created or updated. <?php function wpse_250785_sync_user_login_with_email($user_id) { $user = new WP_User($user_id); if ($user->user_login != $user->user_email) { $user->user_login = $user->user_email; wp_update_user($user); } } add_action(‘user_register’, ‘wpse_250785_sync_user_login_with_email’); add_action(‘profile_update’, ‘wpse_250785_sync_user_login_with_email’); Disclaimer: Untested, but should work 😉

How do I execute a wp_remote_get call using NTLM authentication?

How do I authenticate WP users from a chrome extension?

WP REST API: check if user is logged in

You shouldn’t pass your nonce to your JavaScript to verify it, since client side scripts can be easily manipulated. Instead, you should get the nonce from your front-end content, and then pass it to server to verify it. After verification, you should decide to output content by server, not by your JavaScript file. Something like … Read more

How to leverage authentication outside of WordPress?

Yes it’s possible. But I prefer not to give a beginner lesson in brute force attacks. I recommend you take a look at wp-api it uses OAuth Authentication for remote apps. It’s the way to go by all means.

+ More