Verify if user is wordpress logged in from another app since wordpress 4.0

Ok i’ve found the solution.

In fact, as i haven’t noticed, there is always the hashed mdp, but for now, the logged_in cookie is structured like this :

%login%|%timeout%|%sessionId%|%passhached%

instead of :

%login%|%timeout%|%passhached%

This is like this since wordpress 4.0, and the wp_session_cookie integration, the auth method is the same that before but there is just 2 change :

• the sessionid is introduced in the cookie and the key calculation
• the logged_in cookie encryption is sha256 or if not possible sha1

So there is a scheme of the encryption process

KEY = md5_HMAC(%login%|%caracter 8-12 of the passhached in database%|%timeout%|%sessionId% , LOGGED_IN_KEY.LOGGED_IN_SALT);

RESULT = sha256_HMAC(%login%|%timeout%|%sessionId% , KEY);
// RESULT = sha1_HMAC(%login%|%timeout%|%sessionId% , KEY); only if sha256 is not supported

And for now, to approve a connexion, the logged_in_cookie’s pass hached need to be same as RESULT