wordpress

WordPress Plugin for Auth0 Authentication

MIT License

Downloads
6.3K
Stars
153
Committers
46
View Code on GitHub Visit Website
Ecosystems: Wordpress, Auth0

Bot releases are hidden (Show)

wordpress - 4.6.2 Latest Release

Published by evansims 3 months ago

Full Changelog

Fixed

  • Resolved an issue with corrupted JSON payloads.
wordpress - 4.6.1

Published by evansims 3 months ago

Changed

  • Tested against WordPress 6.5.5 w/ PHP 8.3.
  • Improved translated string handling.

Fixed

  • Resolved issue with ?wle parameter handling.
wordpress - 5.2.1

Published by evansims 5 months ago

Fixed

  • Resolves an issue in which the fallback URI secret isn't shown. #903 (HPiirainen)
  • Resolves a compatibility issue with changes in WordPress 6.5 causing invalidated sessions. (evansims)
wordpress - 4.6.0

Published by evansims 9 months ago

Full Changelog

Added

Changed

You can verify the signature of a downloaded release archive using OpenSSL. Download the public signing key from the GitHub repository and save it to the same directory as the .ZIP and .SIGN files provided with this release, then run the following:

openssl dgst -verify public-signing-key.pub -keyform PEM -sha256 -signature Auth0_WordPress_Plugin_4.6.0.zip.sign -binary Auth0_WordPress_Plugin_4.6.0.zip
wordpress - 5.2.0

Published by evansims 10 months ago

Added

  • feat(SDK-4734): Implement support for Back-Channel Logout #882 (evansims) ¹

Changed

  • Bumped auth0-php dependency version range to ^8.10.
  • Raised the minimum supported PHP version to 8.1.
  • Confirmed support for WordPress 6.4. Updated metadata to reflect support.

[!NOTE]
¹ To use this feature, an Auth0 tenant must have support for it enabled.

wordpress - 5.1.0

Published by evansims about 1 year ago

Added

  • Organization Name support was added for Authentication API and token handling ¹

Updated

  • Bumped tested WordPress version to 6.3.0.
  • Bumped auth0-php dependency version range to ^8.7.
  • Updated telemetry to indicate wordpress package (previously wp-auth0.)

Note
¹ To use this feature, an Auth0 tenant must have support for it enabled. This feature is not yet available to all tenants.

wordpress - 4.5.0

Published by evansims over 1 year ago

Full Changelog

Added

Fixed

  • auth0_update_meta filter not passing $value #847 (QWp6t)
  • wpa0_should_create_user filter not registering with correct parameter count #843 (alyxb)

You can verify the signature of a downloaded release archive using OpenSSL. Download the public signing key from the GitHub repository and save it to the same directory as the .ZIP and .SIGN files provided with this release, then run the following:

openssl dgst -verify public-signing-key.pub -keyform PEM -sha256 -signature Auth0_WordPress_Plugin_4.5.0.zip.sign -binary Auth0_WordPress_Plugin_4.5.0.zip
wordpress - 5.0.1

Published by evansims almost 2 years ago

Full Changelog

Fixed

  • Resolves an issue which sometimes prevented the plugin from being activated on WordPress 6
wordpress - 5.0.0

Published by evansims almost 2 years ago

Full Changelog

Introducing V5 of WP-Auth0 ("Login by Auth0"), a major redesign and upgrade to our WordPress integration plugin. V5 includes many new features and changes:

  • WordPress 6 and PHP 8 support
  • Integration with the Auth0-PHP SDK, and access to its entire API (including Management API calls)
  • High performance background sync using WordPress' Cron feature
  • "Flexible identifier" support, allowing users to sign in using multiple connection types without requiring extra configuration
  • Expanded control over how sign ins without matching existing WordPress accounts are handled
  • Enhanced session pairing between WordPress and Auth0, including session invalidation, access token refresh, and more.

V5 represents a major step forward for our WordPress plugin, and we're excited to see what you build with it!

It's important to note, if you wrote custom theme code or plugins for your WordPress site that targeted previous versions of the plugin, you may need to adjust those themes or plugins to adapt to the new version. We will be rolling this release out to the WordPress plugin store in the near future. Meanwhile, you can manually install the package using Composer using the instructions in the README.

wordpress - 5.0.0 BETA1

Published by evansims almost 2 years ago

⚠️ Version 5.0 of our plugin is now available in Beta. This release adds a significant number of features, and includes breaking changes. We do not recommend using this release in a production environment yet, but your feedback and testing is appreciated.

New Features

  • PHP 8.0 Support — The plugin has been redesigned to use PHP 8.0+ language features.
  • Flexible Connection Matching — This allows users to sign in using multiple connections to the same account. For example, with this you can now sign in using your standard email-password, or social connections you've enabled. Any connection works so long as the authenticating account shares the same (verified) email address.
  • Absentee Account Handling — You can now choose different behaviors for handling when a user signs in successfully, but an account doesn't exist matching the email. Although Auth0 Database Connections have always handled this well on the API side with the 'Disable Sign-Ups' toggle, social connections are trickier in cases where that option doesn't exist. You can now choose to deny those types of authentication requests, or dynamically create new accounts for those users.
  • WP-Cron support — The plugin now leverages the WP background task scheduler to improve performance. Because real-time Management API calls can sometimes fail (rate limits, network congestion on one's hosting provider, etc.) we can now batch changes for WP customers with high traffic sites to more efficiently bring their CMS and Auth0 databases in sync.
  • Session Pairing — WordPress sessions are not completely managed by the plugin, ensuring scenarios like token expiration and refresh tokens are honored and properly acted upon.
  • PSR-18, PSR-17 and PSR-7 Support — All networking functions of the plugin have been rewritten to use the PHP-FIG standards for HTTP messaging. This also removes the library's dependency on Guzzle.
  • WP_Object_Cache support — Caching now uses the native WP_Object_Cache API, for enhanced storage options through third-party plugins. In particular, this is now used for JWKS caching, enabling improved performance.

Breaking Changes

  • PHP 8.0.0 is now the minimum supported version.
  • Embedded login support has been deprecated, and Universal Login is now required.
  • All auth0_ and a0_ prefixed functions have migrated into classes beneath the Auth0\WordPress namespace.
  • All previous JWT processing using third-party libraries has been removed. This is now handled by Auth0's PHP SDK.
  • Auth0\WordPress\Plugin handles the underlying Auth0-PHP SDK initialization and configuration.
  • Auth0\WordPress\Actions\Authentication now handles all authentication functions, and acts as the core for the various WordPress hooks used throughout the system.
  • Auth0\WordPress\Actions\Configuration now handles all Admin UI rendering functions. A new configuration database storage format has been established which will supersede the previous V4 method.
  • Auth0\WordPress\Actions\Sync manages the new WP-Cron scheduled task functions.
  • Sessions have been reworked to support the new Auth0 PHP SDK 8.0+ format.

Additional new features and changes may be added before this new version is released as stable.

wordpress - 5.0.0-BETA0

Published by evansims about 2 years ago

⚠️ Version 5.0 of our plugin is now available in Beta. This release adds a significant number of features. We do not recommend using this release in a production environment yet. There are breaking changes and some functionality remaining to be implemented. In particular, the migration process needs further development and testing. As we move toward General Availability, please be aware that further beta releases may contain additional breaking changes.

A new Beta Channel version of the plugin will be available from the WordPress plugin marketplace soon, which will enable you to opt into receiving updates to new development releases as they happen.

New Features

  • PHP 8.0 Support — The plugin has been redesigned to use PHP 8.0+ language features.
  • Flexible Connection Matching — This allows users to sign in using multiple connections to the same account. For example, with this you can now sign in using your standard email-password, or social connections you've enabled. Any connection works so long as the authenticating account shares the same (verified) email address.
  • Absentee Account Handling — You can now choose different behaviors for handling when a user signs in successfully, but an account doesn't exist matching the email. Although Auth0 Database Connections have always handled this well on the API side with the 'Disable Sign Ups' toggle, social connections are trickier in cases where that option doesn't exist. You can now choose to deny those types of authentication requests, or dynamically create new accounts for those users.
  • WP-Cron support — The plugin now leverages the WP background task scheduler to improve performance. Because real time Management API calls can sometimes fail (rate limits, network congestion on ones hosting provider, etc.) we can now batch changes for WP customers with high traffic sites to more efficiently bring their CMS and Auth0 databases in sync.
  • Session Pairing — WordPress sessions are not completely managed by the plugin, ensuring scenarios like token expiration and refresh tokens are honored and properly acted upon.
  • PSR-18, PSR-17 and PSR-7 Support — All networking functions of the plugin have been rewritten to use the PHP-FIG standards for HTTP messaging. This also removes the library's dependency on Guzzle.
  • WP_Object_Cache support — Caching now uses the native WP_Object_Cache API, for enhanced storage options through third party plugins. In particular, this is now used for JWKS caching, enabling improved performance.

Breaking Changes

  • PHP 8.0.0 is now the minimum supported version.
  • Embedded login support has been deprecated, and Universal Login is now required.
  • All auth0_ and a0_ prefixed functions have migrated into classes beneath the Auth0\WordPress namespace.
  • All previous JWT processing using third-party libraries has been removed. This is now handled by Auth0's PHP SDK.
  • Auth0\WordPress\Plugin handles the underlying Auth0-PHP SDK initialization and configuration.
  • Auth0\WordPress\Actions\Authentication now handles all authentication functions, and acts as the core for the various WordPress hooks used throughout the system.
  • Auth0\WordPress\Actions\Configuration now handles all Admin UI rendering functions. A new configuration database storage format has been established which will supersede the previous V4 method.
  • Auth0\WordPress\Actions\Sync manages the new WP-Cron scheduled task functions.
  • Sessions have been reworked to support the new Auth0 PHP SDK 8.0+ format.

Additional new features and changes may be added before this new version is released as stable.

wordpress - 4.4.0

Published by evansims about 3 years ago

Full Changelog

Added

  • Enable passing extra custom parameters to the New Universal Login #834 (evansims)
  • Update tests to use PHPUnit 7 and Docker #835 (evansims)

Fixed

  • Skip email sync with Auth0 when we know the update is coming from Auth0 #831 (drobin03)
wordpress - 4.3.1

Published by evansims about 3 years ago

Full Changelog

Fixed

  • Update client configuration url for embedded logins #832 (evansims)
wordpress - 4.3.0

Published by evansims over 3 years ago

Full Changelog

Added

wordpress - 4.2.0

Published by evansims over 3 years ago

Full Changelog

Added

Changed

Fixed

wordpress - 4.1.1

Published by joshcanhelp almost 4 years ago

Full Changelog

Fixed

wordpress - 4.1.0

Published by joshcanhelp over 4 years ago

Full Changelog

Closed issues

  • With a custom domain, JWKs aren't being fetched from the correct domain #790

Changed

Fixed

wordpress - 4.0.0

Published by joshcanhelp over 4 years ago

Full Changelog

This is a major release with breaking changes!

In addition to the minimum PHP version being updated from 5.3 to 7.0, there are many breaking removals and changes that are covered in the migration guide included in this release.

Closed issues

  • pt-BR language is not being installed #760
  • Authorization Extension, groups, roles not showing up #701
  • Using the auth0 word in the URL path triggers an authorization code exchange #351

Added

  • PHPCS security scan, sanitization and escaping improvements, and removed custom admin styling (see commits for details)
  • Add settings validation to import #777 (joshcanhelp)
  • Add ability to break cache if RS256 ID token kid is not found #770 (joshcanhelp)
  • Remove error_log calls and add auth0_insert_error action #763 (joshcanhelp)
  • Get new access token via refresh token API #730 (albeja)
  • feature/Adding Brazilian Portuguese translations #729 (niugait)
  • Add wpa0_user_data filter before creating WP_User #717 (horike37)
  • Add check for GET and POST globals for state validation #707 (joshcanhelp)

Changed

Removed

Fixed

wordpress - 3.11.3

Published by joshcanhelp over 4 years ago

Full Changelog

Security

  • Fix potential XSS on wp-login.php override page #768 (kinabalu)
wordpress - 3.11.2

Published by joshcanhelp over 4 years ago

Full Changelog

Important note for sites using the Implicit Login Flow setting: The upcoming changes to SameSite handling in multiple browsers will require sites using the Implicit Login Flow setting to also be served on a secure channel (callback URL using "https"). This setting will be removed in the upcoming major version but is patched for sites that need time to migrate.

Package Rankings
Top 18.1% on Packagist.org
Badges
Extracted from project README's
License
Related Projects
wp-feature-notifications

WP Feature Notifications - a proposal to modernise the way in which WordPress handles emails, adm...

14 Jul 2020 188
amp-wp

Enable AMP on your WordPress site, the WordPress way.

22 Sep 2015 1,787
WordPress-Coding-Standards

PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions

02 May 2011 2,483
authenticator

This plugin allows you to make your WordPress site accessible to logged in users only.

03 Jul 2012 24
wp-plugin-base

Powerful opinated boilerplate for WordPress plugins

29 Apr 2022 13
two-factor

Two-Factor Authentication for WordPress.

23 Oct 2014 724
cliff-wp-plugin-boilerplate

Cliff's WordPress plugin boilerplate

04 Sep 2018 73
WordPress-iOS

WordPress for iOS - Official repository

18 Mar 2013 3,619
wp-cli

⚙️ WP-CLI framework

10 Sep 2011 4,859
starter-plugin

Template for WordPress plugins, it took 7️⃣ years to write

14 Jun 2020 46
wordpress-website-lifecycle

How to work with WordPress 📅 for long years

21 Dec 2022 63
WordPress-Plugin-Boilerplate-Powered

Wordpress Plugin Boilerplate but Powered with examples and a generator!

26 Jun 2014 749
wordpress-framework-utilities

A set of related utility classes to kick start WordPress development.

25 Apr 2020 0
wpvulnerability

Plugin WPVulnerability for WordPress. https://wordpress.org/plugins/wpvulnerability/

16 Apr 2022 26
WordPress

WordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Pl...

01 Dec 2011 18,893