If you will work with sessions, then init this at first in your plugin, theme. add_action( ‘init’, ‘my_start_session’ ); function my_start_session() { if ( session_id() ) return; @session_cache_limiter(‘private, must-revalidate’); //private_no_expire @session_cache_expire(0); @session_start(); } Alternative use the library from Eric Mann: WP Session Manager, also his tutorial.
It finally hit me that javascript would be behind the interim login modal behavior, and that gave me a new direction in my search. I have disabled the new login popups by adding the following to my theme’s functions.php file: // Disable login modals introduced in WordPress 3.6 remove_action( ‘admin_enqueue_scripts’, ‘wp_auth_check_load’ ); If anyone’s interested … Read more
The issue was because I wasn’t generating and sending a nonce value with the request. In order to generate a nonce value. Localize the value of a wp_create_nonce(‘wp_rest’) function call. wp_localize_script(‘application’, ‘api’, array( ‘root’ => esc_url_raw(rest_url()), ‘nonce’ => wp_create_nonce(‘wp_rest’) )); This will then be accessible to the window object of the browser which can be … Read more
There is a function in the user.php of the core files called wp_authenticate_username_password that seems like what you’re looking for. If you want to avoid throwing in the $user object (you probably only have the username + password), then just throw null as 1st function argument in: $check = wp_authenticate_username_password( NULL, ‘some_username’, ‘#thepassw0rd’ ); You … Read more
If I were you, I would look at solutions with Federated Identities. For example OpenID solutions. This link has a lot of examples of implementation on PHP. Advantages: open source, secure protocols, clear documentation
Short answer – Your original function (mostly) works. This is your function edited to do what it needs to do: function automatically_log_me_in( $user_id ) { wp_set_current_user( $user_id ); wp_set_auth_cookie( $user_id ); wp_redirect( home_url( ‘/some-ending-page/’ ) ); exit(); } add_action( ‘user_register’, ‘automatically_log_me_in’ ); Long answer – here is an explanation of why this is the answer. … Read more
ReAuth=1 is required when your login Cookies are no longer valid, WordPress will force validation for your browser. if ( $force_reauth ) $login_url = add_query_arg(‘reauth’, ‘1’, $login_url); Add reauth=1 flag to login url when auth_redirect() redirects to wp-login.php after the auth cookie fails validation wp-login.php clears cookies and forces log in if reauth=1. If reauth=1 … Read more
First of all, I would advise against editing the core files as it will be overwritten when you next update WordPress. Also, you should update WordPress, because it will often include security updates. (It’s recently been reported that there has been a spate of attacks on sites using outdated WordPress versions) In order to achieve … Read more
Your problem is that you call wp_logout_url immediately after wp_set_auth_cookie. wp_set_auth_cookie() does some setcookie() calls. Unfortunately setcookie doesn’t make the new value available instantly in the PHP global $_COOKIE. It must be set through a new HTTP Request first. wp_logout_url() (via wp_nonce_url > wp_create_nonce > wp_get_session_token > wp_parse_auth_cookie) fetches $_COOKIE[LOGGED_IN_COOKIE] in order to create a … Read more
“On login, wordpress uses the wordpress_[hash] cookie to store your authentication details. It’s use is limited to the admin console area, /wp-admin/ After login, wordpress sets the wordpress_logged_in_[hash] cookie, which indicates when you’re logged in, and who you are, for most interface use. WordPress also sets a few wp-settings-{time}-[UID] cookies. The number on the end … Read more