wp_validate_auth_cookie

Source code

function wp_validate_auth_cookie($cookie = '', $scheme = '') {

	if ( ! $cookie_elements = wp_parse_auth_cookie($cookie, $scheme) ) {

		do_action('auth_cookie_malformed', $cookie, $scheme);

		return false;

	}



	extract($cookie_elements, EXTR_OVERWRITE);



	$expired = $expiration;



	// Allow a grace period for POST and AJAX requests

	if ( defined('DOING_AJAX') || 'POST' == $_SERVER['REQUEST_METHOD'] )

		$expired += 3600;



	// Quick check to see if an honest cookie has expired

	if ( $expired < time() ) {

		do_action('auth_cookie_expired', $cookie_elements);

		return false;

	}



	$user = get_user_by('login', $username);

	if ( ! $user ) {

		do_action('auth_cookie_bad_username', $cookie_elements);

		return false;

	}



	$pass_frag = substr($user->user_pass, 8, 4);



	$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);

	$hash = hash_hmac('md5', $username . '|' . $expiration, $key);



	if ( $hmac != $hash ) {

		do_action('auth_cookie_bad_hash', $cookie_elements);

		return false;

	}



	if ( $expiration < time() ) // AJAX/POST grace period set above

		$GLOBALS['login_grace_period'] = 1;



	do_action('auth_cookie_valid', $cookie_elements, $user);



	return $user->ID;

}