How to check if you're logged in to WordPress from Go
1 min read

How to check if you're logged in to WordPress from Go

166 words
Categories:
Web Development
Tags:
#Cookie #Go #wordpress

As a proof of concept, I’m making a small API in Golang that, on an Apache with mod_proxy, serves certain content to a WordPress site.

The small challenge, which is really small, is knowing from that mini application in Go, and through the wordpress_logged_in_XXXXXX cookie who the user is (if they’re logged in).

To see how WP composes the cookie, you only need to look at the source code, and this is how it could be solved in Go

GitHub Gist
Ver en GitHub →
package main
import (
"crypto/hmac"
"crypto/md5"
"crypto/sha256"
"encoding/hex"
"fmt"
"strings"
)
type cookieWP struct {
User string
Scheme string
Expiration string
Token string
Hmac string
}
func main() {
// cookieName -> wordpress_logged_in + md5( domain )
// cookieName := `wordpress_logged_in_d33f7171d85009b773bd2aab4967e7f8`
// wp-config.php define('LOGGED_IN_KEY', [...]);
loggedKey := "TLA$Zt1tTX5&{V,`sa8^I&p%dA^CJ~,0t?]*dG}V8gW=5lGc1l{0hO3=.vJ+qbi-"
// wp-config.php define('LOGGED_IN_SALT', [...]);
loggedSalt := "=B^Bd+prt?@UVG=NClBUbq;}iY{d|5m 7Y4R3sws-+5ddEJHW,3J`{=.]OUGY1Hb"
// the content of cookie
cookieValue := `admin%7C1427358559%7Cg3JkuKWnFFTsynJkHRb7zplvCKQJH8rvmqPdOXDnctB%7Cc3510f74afcd0fd0ddb8e5096dd59d00f6843e5df645081723afa091286cef6a`
elements := strings.Split(cookieValue, `%7C`)
cookie := &cookieWP{
Scheme: "logged_in",
User: elements[0],
Expiration: elements[1],
Token: elements[2],
Hmac: elements[3],
}
// passFragment is the substring (8, 4 ) of db wp_users, field user_pass
// where user_login = cookie.User
// substring 8:4
passFragment := `a938`
fromKey := cookie.User + `|` + passFragment + `|` + cookie.Expiration + `|` + cookie.Token
hasher := hmac.New(md5.New, []byte(loggedKey+loggedSalt))
hasher.Write([]byte(fromKey))
hashed := hex.EncodeToString(hasher.Sum(nil))
hashercheck := hmac.New(sha256.New, []byte(hashed))
hashercheck.Write([]byte(cookie.User + `|` + cookie.Expiration + `|` + cookie.Token))
hashedcheck := hex.EncodeToString(hashercheck.Sum(nil))
fmt.Println("hashed ", cookie.Hmac, " -> ", hashedcheck)
if cookie.Hmac == hashedcheck {
fmt.Println("hello ", cookie.User)
} else {
fmt.Println("bad cookie for ", cookie.User)
}
}
view raw checkCookieWordpress.go hosted with ❤ by GitHub

Notes:

  1. I don’t check the Expiration value in this example

  2. This code won’t work for me in the project since I’ll change, through a hook in WP, how the cookie is created and validated by adding 2 more elements to the hash method (to give a bit of extra security): The validated user’s IP and the Browser used (Agent), since I consider WP’s default format too “weak”.

Comments

Latest Posts

1 min

106 words

Options Pattern in Golang

Option pattern is a functional programming pattern that is used to provide optional arguments to a function that can be used to modify its behavior.

How to create a simple event streaming in Laravel?

Event streams provide you with a way to send events to the client without having to reload the page. This is useful for things like updating the user interface in real-time changes are made to the database.

5 min

939 words

Moments of change, moments of evolution, a constant in my life, with the 25th anniversary of the creation of the web I’ve entered “review” mode and I’m highly perplexed.

I’ve been doing things for the same time (25 years), enjoying, always with the same concept and particularity: Enjoyment and result, but it hasn’t been relevant for a long time (which is also not very relevant).

I’ve realized that the usual thing is to do things within your comfort zone, and I’ve never had one or knew one could exist, hence I’ve touched and done unusual things or perhaps “untimely”, when a certain technology could be in fashion “Buzz” I hadn’t been using it for a long time because it didn’t give me what something else gave me,…

1 min

60 words

From Cayley we can make queries via REST in two “languages”: MQL and a reduced version of Gremlin

With the following example, we can obtain the most common skills of people who belong to an industry, within the “Edu” sector

GitHub Gist
Ver en GitHub →
var c = { } ;
var x = graph.V("edu").In('in_sector').In('in_industry').Out('has_skill').Tag("id").ForEach(
function ( d ) {
if ( c[d.id] ) {
c[d.id] ++;
} else {
c[d.id] = 1 ;
}
d.count = c[d.id] ;
}
) ;
g.Emit( c ) ;
view raw cayley_count_vertex_gremlin.js hosted with ❤ by GitHub
1 min

147 words

Theme My Login is a plugin that allows us to adapt all elements related to: Registration, Login, … of a WordPress site to our needs.

Inside the plugin folder, we find the templates in the “templates” folder. As is standard practice, we should not modify these templates directly. We can copy them to the root of our theme and modify them there. From that point on, those templates will be used by our site, without a plugin update affecting the changes made.