wp_authenticate_application_password( WP_User|WP_Error|null $input_user, string $username, string $password ): WP_User|WP_Error|null

Parameters

$input_userWP_User|WP_Error|null

WP_User or WP_Error object if a previous callback failed authentication.

$usernamestring

Username for authentication.

$passwordstring

Password for authentication.

Return

WP_User|WP_Error|null

WP_User on success, WP_Error on failure, null if null is passed in and this isn't an API request.

Cost profile

Measured from the compiled opcodes, not from a stopwatch. Every number here is identical on any machine that runs the same PHP version, and every function in core is ranked by these figures.

Cost class

Heavy

Reaches the database via get_user_by().

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

6–107

Executed per call on PHP 8.4, depending on the branch taken. The body compiles to 166.

Plugin surface

4 hooks

Third-party callbacks on 'application_password_is_api_request', 'application_password_failed_authentication', 'wp_authenticate_application_password_errors' run inside this call, and their cost is not bounded by anything here.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksapply_filters()called directly
• querycontent queryget_user_by()called directly

Further down the call graph this can also reach option, cache, serialize and transient — those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 58 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_authenticate_application_password() can have, taken from its control-flow graph on PHP 8.4.

Across PHP versions

Oldest PHP that compiles this body: 7.4. An instruction is not a fixed amount of time, so a version with the same count is not necessarily the same speed; what the count rules out is a difference in the work itself.

Hooks fired · 6

6 hooks fire while wp_authenticate_application_password() runs, in this order:

1. 1
   apply_filters( application_password_is_api_request )filterline 398 (+26 into the body)

   Filters whether this is an API request that Application Passwords can be used on.

2. 2
   do_action( application_password_failed_authentication )actionline 444 (+72 into the body)

   Fires when an application password failed to authenticate the user.

3. 3
   do_action( wp_authenticate_application_password_errors )actionline 478 (+106 into the body)

   Fires when an application password has been successfully checked as valid.

4. 4
   do_action( application_password_failed_authentication )actionline 482 (+110 into the body)

   Fires when an application password failed to authenticate the user.

5. 5
   do_action( application_password_did_authenticate )actionline 497 (+125 into the body)

   Fires after an application password was used for authentication.

6. 6
   do_action( application_password_failed_authentication )actionline 508 (+136 into the body)

   Fires when an application password failed to authenticate the user.

Uses · 13

• apply_filters()Calls the callback functions that have been added to a filter hook.
• get_user_by()Retrieves user info by a given field.
• is_email()Verifies that an email is valid.
• __()Retrieves the translation of $text.
• wp_is_application_passwords_available()Checks if Application Passwords is globally available.
• wp_is_application_passwords_available_for_user()Checks if Application Passwords is available for a specific user.
• do_action()Calls the callback functions that have been added to an action hook.
• is_wp_error()Checks whether the given variable is a WordPress Error.
• WP_Application_Passwords::is_in_use()Checks if application passwords are being used by the site.
• WP_Error::__construct()Initializes the error.
• WP_Application_Passwords::get_user_application_passwords()Gets a user's application passwords.
• WP_Application_Passwords::check_password()Checks a plaintext application password against a hashed password.

Used by · 1

• wp_validate_application_password()Validates the application password credentials passed via Basic Authentication.

Source

View on Trac ↗View on GitHub ↗

372function wp_authenticate_application_password(373	$input_user,374	$username,375	#[\SensitiveParameter]376	$password377) {378	if ( $input_user instanceof WP_User ) {379		return $input_user;380	}381 382	if ( ! WP_Application_Passwords::is_in_use() ) {383		return $input_user;384	}385 386	// The 'REST_REQUEST' check here may happen too early for the constant to be available.387	$is_api_request = ( ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) );388 389	/**390	 * Filters whether this is an API request that Application Passwords can be used on.391	 *392	 * By default, Application Passwords is available for the REST API and XML-RPC.393	 *394	 * @since 5.6.0395	 *396	 * @param bool $is_api_request If this is an acceptable API request.397	 */398	$is_api_request = apply_filters( 'application_password_is_api_request', $is_api_request );399 400	if ( ! $is_api_request ) {401		return $input_user;402	}403 404	$error = null;405	$user  = get_user_by( 'login', $username );406 407	if ( ! $user && is_email( $username ) ) {408		$user = get_user_by( 'email', $username );409	}410 411	// If the login name is invalid, short circuit.412	if ( ! $user ) {413		if ( is_email( $username ) ) {414			$error = new WP_Error(415				'invalid_email',416				__( '<strong>Error:</strong> Unknown email address. Check again or try your username.' )417			);418		} else {419			$error = new WP_Error(420				'invalid_username',421				__( '<strong>Error:</strong> Unknown username. Check again or try your email address.' )422			);423		}424	} elseif ( ! wp_is_application_passwords_available() ) {425		$error = new WP_Error(426			'application_passwords_disabled',427			__( 'Application passwords are not available.' )428		);429	} elseif ( ! wp_is_application_passwords_available_for_user( $user ) ) {430		$error = new WP_Error(431			'application_passwords_disabled_for_user',432			__( 'Application passwords are not available for your account. Please contact the site administrator for assistance.' )433		);434	}435 436	if ( $error ) {437		/**438		 * Fires when an application password failed to authenticate the user.439		 *440		 * @since 5.6.0441		 *442		 * @param WP_Error $error The authentication error.443		 */444		do_action( 'application_password_failed_authentication', $error );445 446		return $error;447	}448 449	/*450	 * Strips out anything non-alphanumeric. This is so passwords can be used with451	 * or without spaces to indicate the groupings for readability.

History

Introduced in 5.6.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.8.8 tag, from src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.