This is not really a question but a guide on how to make authenticated requests to the WordPress API using JWT. I’m writing this as a reminder to myself and for those who may need some help with the same topic.
We’ve got a small web application that allows users to log in (via WordPress) and remain logged in for a max 15 min session for security purposes. Because most sessions will last longer, I have a small ajax call that’s made on each click of the html document itself.
There’s an existing non-WP site, and I need their users to be able to log in on my new WordPress site with the same credentials they already have.
We’re using JWT (JSON Web Token) for authenticating our WordPress application with an external service. The current flow we’re thinking of is like this:
I can see two cookies: auth and login cookies in wordpress. Why do we need two?
I think one is enough.
I want to authenticate against both: