Okay, after your comments, I think I see what you’re asking but I’m not sure, so I’ll make it as generic as possible. WordPress uses the authenticate filter hook to perform authentication. You can add additional authentication methods by connecting your own functions to this filter. This is an example of an authentication function. This … Read more
if you do not want to (or you cannot) change permissions on wp-content so your web server has write permissions, then add this to your wp-config.php file: define(‘FS_METHOD’, ‘direct’);
You couldn’t have a more perfect solution, since this is precisely what WordPress core itself has to handle. See, in early years WP used just one pass MD5 for passwords. Then they went to better hashing, but obviously it should have kept working with old hashes. Now if you take a look at wp_check_password(), what … Read more
I believe the reason it is overriding all users is how you are evaluating the user role (and when you are doing it). You’re running your check of the user role in mb_current_user_role() and that function assumes the user is logged in, otherwise it sets $user (initially) to null. But when that function is run … Read more
Answering my own question. For plugin developers, the directive is to use current_user_can() in your code as usual in the REST endpoints, as Core does. WordPress 5.4 does not support authenticated requests originated from outside WordPress to the REST API yet. But your clients can use plugins such as Basic Auth, OAuth2 or JWT to … Read more
The problem is that this function is normally used in the backend. To use it in the frontend, you need to add the following filter: add_filter( ‘auth_redirect_scheme’, ‘wpse16975_check_loggedin’ ); function wpse16975_check_loggedin(){ return ‘logged_in’; } Then auth_redirect() will work as expected : redirect users to the login form if they are not logged in.
This question Set up WP Authentication from External API has a link to a blog. That put me in the right direction and shed some light on my work (Thanks @Rup). class CustomLogin { /** * Initializes the plugin. * * To keep the initialization fast, only add filter and action hooks in the constructor. … Read more
Not sure, but currently in my mind the first solution. Do you need the data from WordPress for the authentication. If you include the wp-load.php you have access to WordPress and his functions, maybe to identifier. But the file to include as static path is not really great and solid. define( ‘WP_USE_THEMES’, FALSE ); require( … Read more
Use the Authorization header. Example: $auth = base64_encode( $username . ‘:’ . $password ); $args = [ ‘headers’ => [ ‘Authorization’ => “Basic $auth” ], ‘body’ => $body, ]; $response = wp_remote_post( $url, $args ); $response_body = wp_remote_retrieve_body( $response );
Authorization header is usually stripped by Apache. You can fix it with .htaccess RewriteEngine On RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule .* – [e=HTTP_AUTHORIZATION:%1]