WordPress Passwordless login (custom login)

[ad_1]

Hello, I need some help debugging some PHP code can anyone join a voice? It’s something advanced. I’ve created this function, which allows me to log in with a username and a Key without a password. The second script is to generate the Key code.

function passwordless_login() {
if (isset($_GET[‘login’]) && isset($_GET[‘key’])) {
$login = $_GET[‘login’];
$key = $_GET[‘key’];

$user = check_password_reset_key($key, $login);

if (!is_wp_error($user)) {
wp_set_auth_cookie($user->ID);
wp_redirect(home_url());
exit;
}
}
}
add_action(‘init’, ‘passwordless_login’);

Key Generation code:

$user_login = ‘admin’; //the username that wants to login

// Get the user object based on the provided username or email
$user = get_user_by(‘login’, $user_login);

if ($user) {
// Generate the password reset key
$key = get_password_reset_key($user);

// Output the password reset key
echo ‘Password Reset Key: ‘ . $key;
} else {
echo ‘User

​

So the link to log in would be like this: (this approach works)

**Here is the issue**, where I wrote a function that constructs the URL with the username and key and actually directs the user to the same URL. It doesn’t work, It generates a key and constructs the login Url, and redirects to it but it doesn’t log me in.

Here is the new approach:

// Add a custom endpoint to generate the passwordless login URL
function custom_generate_passwordless_login_url() {
if (isset($_POST[‘username’])) {
$username = $_POST[‘username’];

// Get the user object based on the provided username or email
$user = get_user_by(‘login’, $username);

if ($user) {

// Generate the password reset ky
$key = get_password_reset_key($user);

// Store the key in a session variable too access them from the javascript
session_start();
$_SESSION[‘passwordless_login_key’] = $key;

// Construct the URL with the username and key
$login_url = ‘https://my-web-site.com/wp-login.php?login=’ . $username . ‘&key=’ . $key;

echo $login_url; // Return the generated login URL as the response

} else {
echo ‘User not found.’;
}
}
}
add_action(‘wp_ajax_generate_passwordless_login_url’, ‘custom_generate_passwordless_login_url’);
add_action(‘wp_ajax_nopriv_generate_passwordless_login_url’, ‘custom_generate_passwordless_login_url’);

I invoked this function from my custom login form, which is performing validation using JS.

$.ajax({
url: “/wp-admin/admin-ajax.php”,
method: “POST”,
data: {
action: “generate_passwordless_login_url”,
username: username,
},
success: function (response) {
console.log(“Passwordless Login URL: ” + response);

// Display the key before redirecting
var key = response.substring(response.lastIndexOf(“=”) + 1);
console.log(“Password Reset Key: ” + key);

// window.location.href = response; // Redirect the user to the generated URL
},
error: function (xhr, status, error) {
console.log(“Error: ” + error);
},
});

I used this js snippet after my form submission and it works but when it redirects me to the login.php without logging me in.

My console output is like this:

Passwordless Login URL:

Password Reset Key: $2y$10$6iKhfr3xdN20YPHuytT8zOyWuSdMOk3yDRDq9ePgndDFXOeUpfxZW0

I tried logging in with an admin and another custom role and both don’t work.

[ad_2]