jeremyjsimmons

<p>TWL SSO is a secure single sign-on plugin for WordPress that enables seamless authentication using RS256 JWT tokens from an external SSO application.<br />
This plugin provides login security features and is designed for allowing Twelve Legs Marketing centralized authentication management.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Single Sign In</strong>: Agency employees can log into websites they manage from a central dashboard.</li>
<li><strong>Just-in-Time User Provisioning</strong>: Automatic user creation and role assignment</li>
<li><strong>JWT Validation</strong>: Full RS256 signature verification with JWKS endpoint integration</li>
<li><strong>Key Rotation</strong>: Support key rotation through JWKS endpoint</li>
<li><strong>Role Management</strong>: Flexible role assignment from JWT claims</li>
<li><strong>Referrer Validation</strong>: Enhanced security through referrer validation</li>
<li><strong>Audience Validation</strong>: Ensures tokens are valid for the specific WordPress site</li>
<li><strong>Token Expiration</strong>: Built-in token expiration and clock skew tolerance</li>
<li><strong>Email Validation</strong>: Comprehensive email validation with optional allowlist</li>
<li><strong>Caching</strong>: JWKS caching for improved performance</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Referrer validation to prevent unauthorized access</li>
<li>JWT signature verification using public key cryptography</li>
<li>Issuer validation to ensure tokens come from trusted sources</li>
<li>Audience validation to prevent token reuse across sites</li>
<li>Token expiration validation with configurable leeway</li>
<li>Email format validation and filtering via hook</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>WordPress installations managed centrally by agency</li>
<li>Organization using Google for external identity provider</li>
</ul>
<h3>Usage</h3>
<h4>Authentication Flow</h4>
<ol>
<li>User clicks login link from SSO application sso.twelvelegsmarketing.com</li>
<li>SSO application redirects to WordPress with JWT token: <code>/wp-login.php?action=twl_sso&token=JWT_TOKEN</code></li>
<li>Plugin validates the JWT token signature and claims</li>
<li>Plugin extracts user information from JWT claims</li>
<li>Plugin creates or retrieves WordPress user</li>
<li>Plugin assigns appropriate role based on JWT claims</li>
<li>User is logged into WordPress</li>
</ol>
<h4>JWT Claims</h4>
<p>The plugin expects the following JWT claims:</p>
<ul>
<li><code>email</code> or <code>sub</code>: User’s email address</li>
<li><code>iss</code>: Issuer (must match allowed issuers)</li>
<li><code>aud</code>: Audience (must match WordPress site URL)</li>
<li><code>exp</code>: Expiration time</li>
<li><code>nbf</code>: Not before time (optional)</li>
<li><code>wp_role</code>: WordPress role to assign (optional)</li>
<li><code>name</code>: User’s display name (optional)</li>
<li><code>given_name</code>: User’s first name (optional)</li>
<li><code>family_name</code>: User’s last name (optional)</li>
</ul>
<h4>Configuration</h4>
<p>The plugin automatically configures itself based on the WordPress environment:</p>
<ul>
<li><strong>Production</strong>: Only allows <code>https://sso.twelvelegsmarketing.com</code> as issuer</li>
<li><strong>Development/Staging</strong>: Also allows <code>https://localhost:8443</code> as issuer</li>
</ul>
<h4>Customization</h4>
<p>You can customize the plugin behavior using WordPress filters:</p>
<ul>
<li><code>twl_sso_allow_email</code>: Filter to control which email addresses are allowed</li>
<li><code>twl_sso_allowed_roles</code>: Filter to control which roles can be assigned</li>
<li><code>twl_sso_allowed_issuers</code>: Filter to control which issuers are allowed</li>
</ul>
<h3>Support</h3>
<p>For support, please contact Twelve Legs Marketing at https://twelvelegsmarketing.com</p>
<h3>Privacy Policy</h3>
<p>This plugin does not collect, store, or transmit any personal data. All authentication is handled through secure JWT tokens from your configured SSO provider.</p>


Twelve Legs Marketing SSO

Single sign-on plugin for WordPress that accepts RS256 JWTs from the TWL SSO application for secure authentication.

Sébastien Dumont

CoCart Headless

<p>This free add-on for <a href="https://cocartapi.com/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">CoCart</a> allows you to authenticate the Cart API via JSON Web Tokens as an authentication method.</p>
<p>JSON Web Tokens are an open standard <a href="https://datatracker.ietf.org/doc/html/rfc7519" rel="nofollow ugc">RFC 7519</a> for securely transmitting information between parties.</p>
<p><a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/concepts.md" rel="nofollow ugc">Read the core concept for more information</a> on what this plugin does and can do.</p>
<p>★★★★★</p>
<blockquote>
<p>An excellent plugin, which makes building a headless WooCommerce experience a breeze. Easy to use, nearly zero setup time. <a href="https://wordpress.org/support/topic/excellent-plugin-8062/" rel="ugc">Harald Schneider</a></p>
</blockquote>
<h3>Key Features</h3>
<ul>
<li><strong>Standard JWT Authentication</strong>: Implements the industry-standard RFC 7519 for secure claims representation.</li>
<li><strong>Simple Endpoints</strong>: Offers clear endpoints for generating and validating tokens.</li>
<li><strong>Configurable Secret Key</strong>: Define your unique secret key via <code>wp-config.php</code> for secure token signing.</li>
<li><strong>Multiple signing algorithms</strong>: <code>HS256</code>, <code>HS384</code>, <code>HS512</code>, <code>RS256</code>, <code>RS384</code>, <code>RS512</code>, <code>ES256</code>, <code>ES384</code>, <code>ES512</code>, <code>PS256</code>, <code>PS384</code>, <code>PS512</code></li>
<li><strong>Rate Limiting</strong>: Controlled specifically for refreshing and validating tokens. Requires <a href="https://cocartapi.com/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart Plus</a></li>
<li><strong>Helpful Debugging</strong>: Detailed logs of authentication issues to help figure out exactly what happened and fix it faster.</li>
<li><strong>WP-CLI Commands</strong>: Useful <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/wp-cli.md" rel="nofollow ugc">commands to handle tokens</a> – whether you need to check, destroy or create new ones, or clean up old ones.</li>
<li><strong>Developer Hooks</strong>: Provides <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/filters.md" rel="nofollow ugc">filters</a> and <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/hooks.md" rel="nofollow ugc">hooks</a> for more configuration to your requirements.</li>
</ul>
<p>For support, please join the <a href="https://cocartapi.com/community/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">community on Discord</a>. For priority support, consider upgrading to <a href="https://cocartapi.com/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">CoCart Plus</a>.</p>
<h3>📄 Documentation</h3>
<p>See documentation on how to <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/guide.md" rel="nofollow ugc">get setup</a>, <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/filters.md" rel="nofollow ugc">filters</a> and <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/hooks.md" rel="nofollow ugc">hooks</a> with examples to help configure JWT Authentication to your needs.</p>
<p>Once ready to use, see the <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/quick-start.md" rel="nofollow ugc">quick start guide</a>. There is also an <a href="https://github.com/cocart-headless/cocart-jwt-authentication/blob/master/docs/advanced-configuration.md" rel="nofollow ugc">advanced configuration</a> for using RSA Keys.</p>
<p>★★★★★</p>
<blockquote>
<p>Amazing Plugin. I’m using it to create a react-native app with WooCommerce as back-end. This plugin is a life-saver! <a href="https://wordpress.org/support/topic/amazing-plugin-1562/" rel="ugc">Daniel Loureiro</a></p>
</blockquote>
<h4>👍 Add-ons to further enhance CoCart</h4>
<p>We also have other add-ons that extend CoCart to enhance your headless store development.</p>
<ul>
<li><strong><a href="https://wordpress.org/plugins/cocart-cors/" rel="ugc">CoCart – CORS</a></strong> enables support for CORS to allow CoCart to work across multiple domains.</li>
<li><strong><a href="https://wordpress.org/plugins/cocart-rate-limiting/" rel="ugc">CoCart – Rate Limiting</a></strong> enables the rate limiting feature.</li>
<li>and more add-ons in development.</li>
</ul>
<p>These add-ons of course come with support too.</p>
<p>For additional security, consider our <a href="https://apisecurity.pro/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">API Security</a> plugin that provides a firewall to block unknown outsiders, rate limit requests and protect data exposure – no configuration required.</p>
<h3>⌨️ Join our growing community</h3>
<p>A Discord community for developers, WordPress agencies and shop owners building the fastest and best headless WooCommerce stores with CoCart.</p>
<p><a href="https://cocartapi.com/community/?utm_medium=wp.org&utm_source=wordpressorg&utm_campaign=readme&utm_content=cocart" rel="nofollow ugc">Join our community</a></p>
<h3>🐞 Bug reports</h3>
<p>Bug reports for CoCart – JWT Authentication are welcomed in the <a href="https://github.com/cocart-headless/cocart-jwt-authentication" rel="nofollow ugc">CoCart – JWT Authentication repository on GitHub</a>. Please note that GitHub is not a support forum, and that issues that aren’t properly qualified as bugs will be closed.</p>
<h3>More information</h3>
<ul>
<li>The official <a href="https://cocartapi.com/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart API plugin</a> website.</li>
<li><a href="https://cocart.dev/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">CoCart for Developers</a>, an official hub for resources you need to be productive with CoCart and keep track of everything that is happening with the API.</li>
<li>The CoCart <a href="https://cocartapi.com/docs/?utm_medium=website&utm_source=wpplugindirectory&utm_campaign=readme&utm_content=readmelink" rel="nofollow ugc">Documentation</a></li>
<li><a href="http://eepurl.com/dKIYXE" rel="nofollow ugc">Subscribe to updates</a></li>
<li>Like, Follow and Star on <a href="https://www.facebook.com/cocartforwc/" rel="nofollow ugc">Facebook</a>, <a href="https://twitter.com/cocartapi" rel="nofollow ugc">Twitter</a>, <a href="https://www.instagram.com/cocartheadless/" rel="nofollow ugc">Instagram</a> and <a href="https://github.com/co-cart/co-cart" rel="nofollow ugc">GitHub</a></li>
</ul>
<h4>💯 Credits</h4>
<p>This plugin is developed and maintained by <a href="https://twitter.com/sebd86" rel="nofollow ugc">Sébastien Dumont</a>.<br />
Founder of <a href="https://twitter.com/cocartheadless" rel="nofollow ugc">CoCart Headless, LLC</a>.</p>


Twelve Legs Marketing SSO vs CoCart JWT Authentication