hectavex

<p>New providers and features are being added regularly! See the <a href="https://wordpress.org/plugins/wp-oauth/changelog/" rel="ugc">Changelog</a> for details.</p>
<p>As a reminder, WP-OAuth is a still a pre-v1.0 release, which means some features may not work as intended or might change over time. Please report any bugs/issues to the support forum so they can be fixed as soon as possible. Thank you!</p>
<h4>Facts</h4>
<ul>
<li>With so many sites offering membership now, users may suffer registration fatigue and forget their passwords, or use the same password for several sites, increasing their security risk.</li>
<li><a href="http://www1.janrain.com/rs/janrain/images/Industry-Research-Value-of-Social-Login-2013.pdf" rel="nofollow ugc">56% of consumers</a> have at least one major social network profile they could be using for membership, registration and login purposes across multiple websites without having to maintain multiple accounts and passwords (2013).</li>
<li><a href="http://www.marketingprofs.com/charts/2012/7060/social-media-users-prefer-social-login-over-traditional" rel="nofollow ugc">40% of consumers</a> currently utilize social login (2012).</li>
</ul>
<h4>Features</h4>
<ul>
<li>Free, unlimited, unbranded and white-labeled from the beginning. No upselling, no payment plans, no SaaS, no proxy authentication! WP-OAuth communicates from your WordPress site <em>directly</em> with the <em>trusted</em> third-party login providers.</li>
<li>WP-OAuth collects and stores ONLY the user’s <em>OAuth identity</em> in the WordPress database for future logins; no other user information is collected or stored.</li>
<li>Fully integrates with WordPress. Drops into existing WordPress sites and integrates with existing WordPress users.</li>
<li>Supports third-party authentication with Google, Facebook, LinkedIn, Github, Reddit, Windows Live, PayPal and Instagram via OAuth 2.0 / OpenID Connect. Providers can be enabled or disabled.</li>
<li>Automatic user registration if <em>Anyone can register</em> has been enabled under Settings > General > Membership.</li>
<li>Users can manage their third-party login providers via the standard “Your Profile” WordPress page. They may link more providers, or unlink existing providers.</li>
<li>Displays a message via Javascript to the user when they login or logout. This feature can also be disabled.</li>
<li>Add a custom login form to any post or page using the [wpoa_login_form] shortcode. Choose from 4 different layouts. See <a href="https://wordpress.org/plugins/wp-oauth/installation/" rel="ugc">Installation</a> for details.</li>
<li>Customize the default login screen with a logo or background. Point the logo URL to your home page instead of WordPress.org. Hide the default username/password login form if you want. Automatically include login buttons for any providers that are enabled.</li>
<li>Supports cURL or stream context for the authentication flow, meaning the plugin should be compatible with a wide range of PHP servers.</li>
<li>The authentication flow was adapted from code samples provided by Google, Facebook and LinkedIn. It has been updated, rigorously tested and debugged for solid error handling. Provider implementations share much of the same code (very high code re-use) and the differences between the providers have been fully documented.</li>
<li>The user experience and on-boarding process was inspired by StackExchange/StackOverflow login system.</li>
<li>Extremely light-weight, optimized code base for high performance. Doesn’t require third-party OAuth libraries; everything is built first-class into the plugin. Previously, WP-OpenLogin required LightOpenID and Facebook-PHP-SDK, but this is no longer necessary. Keeps the bloat low and the performance high. Tested with P3 Plugin Profiler, WP-OAuth’s plugin overhead is around 0.001 seconds which is 6x less overhead than Akismet in the same run! That means there shouldn’t be a performance hit.</li>
</ul>
<h4>How to Contribute</h4>
<p>Visit the <a href="https://github.com/perrybutler/WP-OAuth" rel="nofollow ugc">GitHub development repository</a>.</p>
<h3>History</h3>
<p>This project is a continuation of <a href="http://github.com/perrybutler/wp-openlogin" rel="nofollow ugc">WP-OpenLogin</a> which was originally developed with OpenID in mind. We’re moving on; OAuth 2.0 is now the standard.</p>


WP-OAuth

Allows users to login or register by authenticating with an existing Google, Facebook, LinkedIn, Github, Reddit (and more!) account via OAuth 2.0.

Justin Greer

Jayson T Cote

<p>Connect your app to WordPress or use SSO to connect multiple websites with the same username and passwords. No 3rd party servers are needed with WP OAuth Server. Everything you need is in this plugin.</p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/ZOUsY4Kp_6U?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h4>Features</h4>
<ul>
<li>WP REST API Authentication. Provides ability to make authorized calls to protected REST API endpoints.</li>
<li>WP REST API Lock Down. Prevent any calls to the REST API unless authorized</li>
<li>Unlimited OAuth 2.0 Clients</li>
<li>Support for Implicit Flow</li>
<li>Built-In Resource Server</li>
<li>Automated Authorization Flow (User does not have to see authorization screen)</li>
<li>Easily Extend/ Modify the Endpoints</li>
<li>OAuth 2.0 PKCE</li>
<li>Modern and Legacy JWT authorization support. OAuth 2.0 JSON Web Token Support</li>
</ul>
<h4>Supported Grant Types</h4>
<ul>
<li>Authentication Code w/Implicit</li>
<li>User Credentials (Pro)</li>
<li>Client Credentials (Pro)</li>
<li>Refresh Token (Pro)</li>
<li>OpenID Connect (Pro)</li>
<li>OpenID Discovery</li>
<li>Public Clients (Pro)</li>
<li>Public Client Proof of Key Exchange (PKCE)</li>
</ul>
<h4>Supports</h4>
<ul>
<li>Connecting any Custom Mobile and Desktop Application to WordPress’s Backend.</li>
<li>Any software or web platform utilizing OAuth 2.0.</li>
<li>Allows RocketChat to use WordPress as a Backend.</li>
<li>Connects Moodle LMS and use WordPress users.</li>
<li>Alexa Skills Authentication</li>
<li>Tribe.so Community OAuth 2 SSO Support</li>
</ul>
<h4>How to Use</h4>
<p>Visit https://wp-oauth.com/support/documentation/ for detailed documentation on installing, configuring and using<br />
WordPress OAuth Server.</p>
<h4>Licensing</h4>
<p>WP OAuth Server is free to use. Please support the project by licensing. You can view more information at<br />
https://wp-oauth.com.</p>
<h4>Minimum Requirements</h4>
<ul>
<li>PHP 5.6.4 or greater <em>(latest version recommended)</em></li>
<li>OpenSSL installed and enabled if you plan on using OpenID Connect</li>
</ul>
<h4>Other Information</h4>
<ul>
<li>NOTE: As of 3.0.0, there are no backward compatibility for any version older than 3.0.0</li>
<li>NOTE: Due to IIS’s inability play nice, WP OAuth Server may work but is very limited for Windows OS.</li>
</ul>
<h4>Support</h4>
<p>Support requests should be made by opening a support request at https://wp-oauth.com/support/submit-ticket/.</p>


WP OAuth Server (OAuth Authentication)

There is no answer even on the premium version website. The plugin is abandoned, with legacy code and some bugs. Please, choose an alternative decision. Didn't use this one!

Abandoned plugin


I just want to say thank you to the developer, you have done a great job and saved me a tonne of time :)


This plugin is really fantastic


I tested WP OAuth Server (OAuth Authentication) in integration with a client application and found a serious issue: even after the user logs out from WordPress, the issued access token is still accepted by the /oauth/me endpoint, returning all user data.



This means any client application that has stored the token can continue accessing private information indefinitely, until the token expires, without verifying if the session on the server has ended.



I tried to work around the issue by enabling the introspection endpoint and validating the token on each request, but the plugin does not revoke the token on logout, making introspection ineffective for detecting logouts.



This flaw breaks a basic security principle of OAuth 2.0 and may expose sensitive data. I do not recommend using this plugin until token revocation upon logout is implemented.


Serious security flaw — tokens remain valid after logout

Adds Authentication through OAuth 2. Provides the ability for Single Sign On for websites & Mobile Applications.

WP-OAuth vs WP OAuth Server (OAuth Authentication)