The is a generalized authentication verification scheme that authorizes a user if the logged_in cookie is set and valid, & verifies the wp_rest nonce action for both authorized & anonymous users.

The WPAuthConfig failure handler will be used if a Cookie is present but invalid or if the nonce is missing/invalid.

Configuration data specific to your Wordpress site & Haskell application.

The data needed for authentication, along with some arbitrary data that is returned on success.

The result of the authorizeWordpressRequest function can be an authorized user with some additional data, or an anonymous user.

Potential errors during authentication.

The name of a Wordpress authentication cookie. Wordpress's frontend uses CookieNameWithMD5 "wordpress_logged_in_" "<your-site-url>" by default.

Build the name of an authentication cookie from a CookieName, hashing the suffix if present.

Try to find & decode a Cookie in the headers with the given name.

Potential errors while searching for a specific cookie in the request headers.

Try to find & decode a Nonce in either the X-WP-Nonce header or the _wpnonce query parameter.

This represents a Cookie set by a Wordpress authentication scheme (auth, auth_sec, & logged_in).

A User's Wordpress Session Token from an auth cookie.

Parse a WPCookie from the body text of an auth, auth_sec, or logged_in cookie.

Potential errors we may encounter while parsing a WPCookie.

Validate a Wordpress Authentication Cookie by verifying that the hash & token in the cookie are valid and the expiration time is in the future.

The user_pass field from the users table of a Wordpress site.

Potential validation errors for a WPCookie.

Determine if a WPCookie's hash matches the hashed password & token.

A secret is generated by hashing the user, password, expiration, & token. This secret is then used to hash the user, expiration, & token. The resulting hash should match the hmac hash in the WPCookie.

A User Session's Token. These can be found in the usermeta Wordpress table for rows where meta_key="session_token".

You'll probably want to use decodeSessionTokens to parse the tables's meta_value instead of constructing them yourself.

Decode a serialized PHP array containing a User's Session Tokens. These are usually stored as the session_tokens usermeta.

It may be an associative array of tokens to expiration times, or tokens to an associative array of sub-fields:

array(
  'some-random-hex-text' => 192836504,
  // ...
);
array(
  'deadbeef ' => array(
    'expiration' => 9001,
    // ...
  ),
);

Determine if the SHA256 hash of the token matches one of the unexpired session tokens.

The tick number of a Wordpress site - required for Nonce verification.

A port of the wp_nonce_tick function. Calculates the nonce tick number, where each nonce has a lifetime of two ticks.

Determine if the tick-dependent hash of the CookieToken matches the hash of the current or previous tick.

The ID field from the users table of a Wordpress site.

A port of the wp_hash function. This performs an hmac hash on some text using a secret derived from the authentication scheme's key & salt constants.

A port of the wp_salt function. Builds a secret key for a hashing function using the auth scheme's key & salt.

This represents one of the $schemes that Wordpress's cookie/nonce functions use to salt their hashes.

The built-in Wordpress schemes are auth/auth_sec for HTTP/HTTPS requests to wp-admin, logged_in for authenticated front-end requests, & nonce for form submissions & API requests.

The secret keys & salts are constants found in your wp-config.php file, defined as LOGGED_IN_SALT, LOGGED_IN_KEY, etc.

An auth scheme's _KEY constant, usually defined in your Wordpress site's wp-config.php. E.g., LOGGED_IN_KEY

An auth scheme's _SALT constant, usually defined in your Wordpress site's wp-config.php. E.g., LOGGED_IN_SALT

Build the _KEY value for an authentiation scheme.

Build the _SALT value for an authentiation scheme.