I'm trying to develop an auto login system, and I'm having problems with NONCE.
The code I'm using:
if ( 'REGULAR_USER' == $payload->role ) {
$user_login = $payload->preferred_username;
$user = get_user_by('email', $user_login);
$user_id = $user->ID;
clean_user_cache( $user_id);
wp_clear_auth_cookie();
wp_set_current_user($user_id, $user_login);
wp_set_auth_cookie($user_id);
do_action('wp_login', $user_login, $user);
update_user_caches( $user );
}
The variables I get from a JWT token. Everything apparently works. Login is successful.
Problems are triggered when the user tries to do some action that checks nonces.
Explaining better: the application is based on Tutor LMS. The user who automatically logs in to the site cannot, for example, finish the class. That's because at the end of classes, the Tutor triggers a function called checking_nonce(). When the check fails, the function returns: "Nonce not matched. Action failed!"
Here's the code itself that checks inside the Tutor LMS
public function checking_nonce( $request_method = null ) {
! $request_method ? $request_method = $_SERVER['REQUEST_METHOD'] : 0;
$data = strtolower( $request_method ) === 'post' ? $_POST : $_GET;
$nonce_value = sanitize_text_field( tutor_utils()->array_get( tutor()->nonce, $data, null ) );
$matched = $nonce_value && wp_verify_nonce( $nonce_value, tutor()->nonce_action );
if ( ! $matched ) {
wp_send_json_error( array( 'message' => __( 'Nonce not matched. Action failed!', 'tutor' ) ) );
exit;
}
}
A second test was done (to check role permissions). I registered the user as an administrator, did the auto login, and the problem remains.
Important detail: if that same user logs in through wp-admin and tries to finish a class, the error does not happen and everything works correctly.
Are there any different directives that need to be added to not have these issues with nonce validation?