You can not set cookies form site A that will be applicable on site B, therefor your “login by proxy” scheme will not work, and can not be made to work. In addition storing passwords in plain text is just a big no-no.
I know it’s a bit far fetched, but might help. For anyone looking for WP REST API implementation with JWT, here’s our solution. Add it to your function.php add_action(‘rest_api_init’, ‘wp_rest_user_endpoints’); /** * Register a new user * * @param WP_REST_Request $request Full details about the request. * @return array $args. **/ function wp_rest_user_endpoints($request) { /** … Read more
What you found is actually perfectly accurate. With WP’s commitment to backwards compatibility it’s not that common for thing to stop working. This filter is used in wp_set_auth_cookie() to calculate the duration. Resulting value is used in PHP’s setcookie(). There is no mention of specifics limits in documentation, so in practice the value is limited … Read more
The function wp_logout (https://github.com/WordPress/WordPress/blob/master/wp-includes/pluggable.php#L564) calls the function wp_clear_auth_cookie (https://github.com/WordPress/WordPress/blob/master/wp-includes/pluggable.php#L928) which sets the expiration dates of all involved cookies to something in the past. Also for the LOGGED_IN_COOKIE. Hence, what you observe is strange. For sites that I maintain, the cookie will be cleared when I log out.
function checkApiAuth( $result ){ $yourEncryptAPIKey = $_GET[‘request’]; if( yourDecryptFn( $yourEncryptAPIKey ) === $realKey ): $result = true; else: $result = false; endif; return $result; } add_filter(‘rest_authentication_errors’, ‘checkApiAuth’);
Your option using WP internals would be to use the HTTP API along with wp schedule event Create a scheduled event, something like: register_activation_hook(__FILE__, ‘my_schedule’); add_action(‘execute_my_url’, ‘do_this_daily’); function my_schedule() { $timestamp = //some time you want it to run wp_schedule_event($timestamp, ‘daily’, ‘execute_my_url’); } function do_this_daily() { wp_remote_get( ‘../ =myvideoblog/mvb_main.php&action=processfeed&updatefeed=67’, $args); } This is a simple … Read more
Getting user names and passwords is a horrible idea I hope no user will actually agree to, but beyond that your idea to do it from JS is going to fail due to CORS, which means you will have to do it in AJAX to your server, and let your server try to login, which … Read more
GET requests, like listing posts, doesn’t need authentication at least you need to get private posts. Your problem is that you are using a route/endpoint that doesn’t exist. In WordPress 4.4, WP REST API infrastructure was merged, endpoints didn’t; they will be merged in WordPress 4.5 (as WordPress 4.6 it seems endpoints are still don’t … Read more
This should do it: add_action(‘plugins_loaded’, function(){ wp_set_current_user(0); },0);
The wp_ajax_{action} hook only fires for logged in users. For logged-out users the action wp_ajax_nopriv_{action} is triggered on an ajax request – so you need to hook into that as well.