# wp_validate_auth_cookie()

URL: https://chugunov.pro/api-wordpress/functions/wp_validate_auth_cookie/
Проверено на WordPress 6.9, обновлено 06.08.2026.
Источник: независимый русскоязычный справочник chugunov.pro. Не является официальной документацией WordPress.

Тип: функция.
Появился в версии: 2.5.0.

## Сигнатура

```php
wp_validate_auth_cookie( string $cookie = '', string $scheme = '' ): int|false
```

## Описание

Проверки включают удостоверение того, что cookie аутентификации установлен, и получение его содержимого (если не используется $cookie).
Убеждается, что срок действия cookie не истёк. Проверяет, что хеш в cookie соответствует ожидаемому, и сравнивает их.

## Параметры

- `$cookie` `string` — необязательный, по умолчанию `''`. Если используется, будет проверяться это содержимое вместо содержимого cookie.
- `$scheme` `string` — необязательный, по умолчанию `''`. Схема cookie для использования: 'auth', 'secure_auth' или 'logged_in'.
  
  Примечание: здесь *нет* значения по умолчанию 'auth', как в других функциях работы с cookie.

## Возвращаемое значение

`int|false`

## Исходный код

Файл: `wp-includes/pluggable.php:782`

```php
function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) {
	$cookie_elements = wp_parse_auth_cookie( $cookie, $scheme );
	if ( ! $cookie_elements ) {
		/**
		 * Fires if an authentication cookie is malformed.
		 *
		 * @since 2.7.0
		 *
		 * @param string $cookie Malformed auth cookie.
		 * @param string $scheme Authentication scheme. Values include 'auth', 'secure_auth',
		 *                       or 'logged_in'.
		 */
		do_action( 'auth_cookie_malformed', $cookie, $scheme );
		return false;
	}

	$scheme     = $cookie_elements['scheme'];
	$username   = $cookie_elements['username'];
	$hmac       = $cookie_elements['hmac'];
	$token      = $cookie_elements['token'];
	$expiration = $cookie_elements['expiration'];

	$expired = (int) $expiration;

	// Allow a grace period for POST and Ajax requests.
	if ( wp_doing_ajax() || 'POST' === $_SERVER['REQUEST_METHOD'] ) {
		$expired += HOUR_IN_SECONDS;
	}

	// Quick check to see if an honest cookie has expired.
	if ( $expired < time() ) {
		/**
		 * Fires once an authentication cookie has expired.
		 *
		 * @since 2.7.0
		 *
		 * @param string[] $cookie_elements {
		 *     Authentication cookie components. None of the components should be assumed
		 *     to be valid as they come directly from a client-provided cookie value.
		 *
		 *     @type string $username   User's username.
		 *     @type string $expiration The time the cookie expires as a UNIX timestamp.
		 *     @type string $token      User's session token used.
		 *     @type string $hmac       The security hash for the cookie.
		 *     @type string $scheme     The cookie scheme to use.
		 * }
		 */
		do_action( 'auth_cookie_expired', $cookie_elements );
		return false;
	}

	$user = get_user_by( 'login', $username );
	if ( ! $user ) {
		/**
		 * Fires if a bad username is entered in the user authentication process.
		 *
		 * @since 2.7.0
		 *
		 * @param string[] $cookie_elements {
		 *     Authentication cookie components. None of the components should be assumed
		 *     to be valid as they come directly from a client-provided cookie value.
		 *
		 *     @type string $username   User's username.
		 *     @type string $expiration The time the cookie expires as a UNIX timestamp.
		 *     @type string $token      User's session token used.
		 *     @type string $hmac       The security hash for the cookie.
		 *     @type string $scheme     The cookie scheme to use.
		 * }
		 */
		do_action( 'auth_cookie_bad_username', $cookie_elements );
		return false;
	}

	if ( str_starts_with( $user->user_pass, '$P$' ) || str_starts_with( $user->user_pass, '$2y$' ) ) {
		// Retain previous behaviour of phpass or vanilla bcrypt hashed passwords.
		$pass_frag = substr( $user->user_pass, 8, 4 );
	} else {
		// Otherwise, use a substring from the end of the hash to avoid dealing with potentially long hash prefixes.
		$pass_frag = substr( $user->user_pass, -4 );
	}

	$key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );

	$hash = hash_hmac( 'sha256', $username . '|' . $expiration . '|' . $token, $key );

	if ( ! hash_equals( $hash, $hmac ) ) {
		/**
		 * Fires if a bad authentication cookie hash is encountered.
		 *
		 * @since 2.7.0
		 *
		 * @param string[] $cookie_elements {
		 *     Authentication cookie components. None of the components should be assumed
		 *     to be valid as they come directly from a client-provided cookie value.
		 *
		 *     @type string $username   User's username.
		 *     @type string $expiration The time the cookie expires as a UNIX timestamp.
		 *     @type string $token      User's session token used.
		 *     @type string $hmac       The security hash for the cookie.
		 *     @type string $scheme     The cookie scheme to use.
		 * }
		 */
		do_action( 'auth_cookie_bad_hash', $cookie_elements );
		return false;
	}

	$manager = WP_Session_Tokens::get_instance( $user->ID );
	if ( ! $manager->verify( $token ) ) {
		/**
		 * Fires if a bad session token is encountered.
		 *
		 * @since 4.0.0
		 *
		 * @param string[] $cookie_elements {
		 *     Authentication cookie components. None of the components should be assumed
		 *     to be valid as they come directly from a client-provided cookie value.
		 *
		 *     @type string $username   User's username.
		 *     @type string $expiration The time the cookie expires as a UNIX timestamp.
		 *     @type string $token      User's session token used.
		 *     @type string $hmac       The security hash for the cookie.
		 *     @type string $scheme     The cookie scheme to use.
		 * }
		 */
		do_action( 'auth_cookie_bad_session_token', $cookie_elements );
		return false;
	}

	// Ajax/POST grace period set above.
	if ( $expiration < time() ) {
		$GLOBALS['login_grace_period'] = 1;
	}

	/**
	 * Fires once an authentication cookie has been validated.
	 *
	 * @since 2.7.0
	 *
	 * @param string[] $cookie_elements {
	 *     Authentication cookie components.
	 *
	 *     @type string $username   User's username.
	 *     @type string $expiration The time the cookie expires as a UNIX timestamp.
	 *     @type string $token      User's session token used.
	 *     @type string $hmac       The security hash for the cookie.
	 *     @type string $scheme     The cookie scheme to use.
	 * }
	 * @param WP_User  $user            User object.
	 */
	do_action( 'auth_cookie_valid', $cookie_elements, $user );

	return $user->ID;
}
```

## История изменений

- 2.5.0 — Introduced.

## Связанные

Использует: [`wp_doing_ajax`](https://chugunov.pro/api-wordpress/functions/wp_doing_ajax/), `WP_Session_Tokens::get_instance`, [`wp_hash`](https://chugunov.pro/api-wordpress/functions/wp_hash/), [`wp_parse_auth_cookie`](https://chugunov.pro/api-wordpress/functions/wp_parse_auth_cookie/), [`get_user_by`](https://chugunov.pro/api-wordpress/functions/get_user_by/), [`do_action`](https://chugunov.pro/api-wordpress/functions/do_action/).
Используется в: [`auth_redirect`](https://chugunov.pro/api-wordpress/functions/auth_redirect/), [`wp_authenticate_cookie`](https://chugunov.pro/api-wordpress/functions/wp_authenticate_cookie/), [`wp_validate_logged_in_cookie`](https://chugunov.pro/api-wordpress/functions/wp_validate_logged_in_cookie/).

Оригинал в официальной документации: https://developer.wordpress.org/reference/functions/wp_validate_auth_cookie/