wp_authenticate_application_password( WP_User|WP_Error|null $input_user, string $username, string $password ): WP_User|WP_Error|null

Parameters

$input_userWP_User|WP_Error|null

WP_User or WP_Error object if a previous callback failed authentication.

$usernamestring

Username for authentication.

$passwordstring

Password for authentication.

Return

WP_User|WP_Error|null

WP_User on success, WP_Error on failure, null if null is passed in and this isn't an API request.

Hooks fired · 6

6 hooks fire while wp_authenticate_application_password() runs, in this order:

1. 1
   apply_filters( application_password_is_api_request )filterline 398 (+26 into the body)

   Filters whether this is an API request that Application Passwords can be used on.

2. 2
   do_action( application_password_failed_authentication )actionline 444 (+72 into the body)

   Fires when an application password failed to authenticate the user.

3. 3
   do_action( wp_authenticate_application_password_errors )actionline 478 (+106 into the body)

   Fires when an application password has been successfully checked as valid.

4. 4
   do_action( application_password_failed_authentication )actionline 482 (+110 into the body)

   Fires when an application password failed to authenticate the user.

5. 5
   do_action( application_password_did_authenticate )actionline 497 (+125 into the body)

   Fires after an application password was used for authentication.

6. 6
   do_action( application_password_failed_authentication )actionline 508 (+136 into the body)

   Fires when an application password failed to authenticate the user.

Uses · 12

• apply_filters()Calls the callback functions that have been added to a filter hook.
• get_user_by()Retrieves user info by a given field.
• is_email()Verifies that an email is valid.
• __()Retrieves the translation of $text.
• wp_is_application_passwords_available()Checks if Application Passwords is globally available.
• wp_is_application_passwords_available_for_user()Checks if Application Passwords is available for a specific user.
• do_action()Calls the callback functions that have been added to an action hook.
• WP_Application_Passwords::is_in_use()Checks if application passwords are being used by the site.
• WP_Error::__construct()Initializes the error.
• WP_Application_Passwords::get_user_application_passwords()Gets a user's application passwords.
• WP_Application_Passwords::check_password()Checks a plaintext application password against a hashed password.
• WP_Application_Passwords::record_application_password_usage()Records that an application password has been used.

Used by · 1

• wp_validate_application_password()Validates the application password credentials passed via Basic Authentication.

Source

View on Trac ↗View on GitHub ↗

372function wp_authenticate_application_password(373	$input_user,374	$username,375	#[\SensitiveParameter]376	$password377) {378	if ( $input_user instanceof WP_User ) {379		return $input_user;380	}381 382	if ( ! WP_Application_Passwords::is_in_use() ) {383		return $input_user;384	}385 386	// The 'REST_REQUEST' check here may happen too early for the constant to be available.387	$is_api_request = ( ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) );388 389	/**390	 * Filters whether this is an API request that Application Passwords can be used on.391	 *392	 * By default, Application Passwords is available for the REST API and XML-RPC.393	 *394	 * @since 5.6.0395	 *396	 * @param bool $is_api_request If this is an acceptable API request.397	 */398	$is_api_request = apply_filters( 'application_password_is_api_request', $is_api_request );399 400	if ( ! $is_api_request ) {401		return $input_user;402	}403 404	$error = null;405	$user  = get_user_by( 'login', $username );406 407	if ( ! $user && is_email( $username ) ) {408		$user = get_user_by( 'email', $username );409	}410 411	// If the login name is invalid, short circuit.412	if ( ! $user ) {413		if ( is_email( $username ) ) {414			$error = new WP_Error(415				'invalid_email',416				__( '<strong>Error:</strong> Unknown email address. Check again or try your username.' )417			);418		} else {419			$error = new WP_Error(420				'invalid_username',421				__( '<strong>Error:</strong> Unknown username. Check again or try your email address.' )422			);423		}424	} elseif ( ! wp_is_application_passwords_available() ) {425		$error = new WP_Error(426			'application_passwords_disabled',427			__( 'Application passwords are not available.' )428		);429	} elseif ( ! wp_is_application_passwords_available_for_user( $user ) ) {430		$error = new WP_Error(431			'application_passwords_disabled_for_user',432			__( 'Application passwords are not available for your account. Please contact the site administrator for assistance.' )433		);434	}435 436	if ( $error ) {437		/**438		 * Fires when an application password failed to authenticate the user.439		 *440		 * @since 5.6.0441		 *442		 * @param WP_Error $error The authentication error.443		 */444		do_action( 'application_password_failed_authentication', $error );445 446		return $error;447	}448 449	/*450	 * Strips out anything non-alphanumeric. This is so passwords can be used with451	 * or without spaces to indicate the groupings for readability.

History

Introduced in 5.6.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.