Over 10 years we help companies reach their financial and branding goals. Engitech is a values-driven technology agency dedicated.

Gallery

Contacts

285A Gateshead Road, Borehamwood, Greater London, WD6 5LZ.

info@vbridge.co.uk

+44 203 488 9980

+0203 488 0088

Blog Laravel Security

In today’s digital ecosystem, it’s common to integrate Laravel-based web applications with community forums or blogs powered by WordPress. But while this multi-platform setup offers the best of both worlds, it introduces a familiar pain point:

How do you log in users to both platforms simultaneously without friction?

The answer: Single Sign-On (SSO) via a lightweight and powerful method — using an <iframe>.   

Goal

Enable auto-login and logout to a WordPress forum when a user logs in or out of a Laravel application — silently and securely.

Why Use an <iframe> for SSO

Traditional SSO implementations often rely on complex OAuth, redirections, or risky CORS setups. An iframe-based SSO allows:

1. Silent cross-platform login without redirection.
2. Session cookie preservation in the browser.
3. Bypass SameSite cookie restrictions.
4. No CORS setup headaches.
5. Easy to maintain after a one-time integration.

Real-World Example: Laravel → WordPress

Scenario:
– Laravel App URL: https://example.com
– WordPress Forum URL: https://forum.example.com

When a user logs in to Laravel, they should automatically be logged into the WordPress forum without any extra steps.

The Problem

WordPress relies on browser sessions and cookies to identify logged-in users. If you try logging in via an HTTP call from Laravel, the cookies are set server-side, not in the user’s browser — resulting in no WordPress session.

The Solution: Let the Browser Do the Work

Use an <iframe> in your Laravel Blade template to make a background call to WordPress:

<iframe src=”https://forum.example.com/?user_id=123&ts=1720923000&sig=xyz” style=”display: none;”></iframe>

This silently opens a WordPress login endpoint that:
1. Verifies the request using HMAC-based signature.
2. Calls wp_set_auth_cookie() to log in the user.
3. Sends proper cookies to the browser.

Securing the Login with HMAC Signature

Laravel-side example:

$secret = config("app.wp_sso_secret");
$timestamp = time();
$signature = hash_hmac('sha256', $wpUserId . '|' . $timestamp, $secret);

WordPress functions.php:

Add following code in the functions.php

add_action('init', function () {
    if (isset($_GET['user_id'], $_GET['ts'], $_GET['sig'])) {   //LOGIN
        $user_id = intval($_GET['user_id']);
        $timestamp = intval($_GET['ts']);
        $signature = $_GET['sig'];
        $secret = 'tqxUAeZWZvXr0m9khJ9FAvWZ'; // MUST match Laravel
        $expected = hash_hmac('sha256', $user_id . '|' . $timestamp, $secret);
        if (hash_equals($expected, $signature) && (time() - $timestamp) < 60) {
            $user = get_user_by('id', $user_id);
            if ($user) {
                wp_set_auth_cookie($user->ID, true);
                wp_set_current_user($user->ID);
            }
        }
    }

  if (isset($_GET['action']) && $_GET['action'] === 'custom-logout') {  //LOGOUT
        wp_logout();
        wp_redirect(home_url()); // or a custom redirect
        exit;
    }
});

Auto Logout Integration

On Laravel logout, insert a hidden iframe to logout WordPress:

<iframe src="https://forum.example.com/?action=custom-logout" style="display: none;"></iframe>

Prerequisite: Create an Application Password in WordPress

1. Login as an admin in WordPress.
2. Go to Users → Profile.
3. Create a new application password (e.g., Laravel Integration).
4. Store this password securely in your Laravel .env file.

Creating or Fetching WordPress Users from Laravel

Fetch existing WordPress user:

$response = Http::withBasicAuth("wp_admin_username", "application_password")
    ->get("https://forum.example.com/wp-json/wp/v2/users", [
    'search' => ""
]);


Create a new WordPress user:

$username = explode(‘@’, $webUser->email)[0] . rand(1000, 9999);
$password = bin2hex(random_bytes(8)); // Random password
$createResponse = Http::withBasicAuth($authUser, $authPass)
                ->post(“$wpApiBase/users”, [
                    ‘username’ => $username,
                    ’email’ => $webUser->email,
                    ‘password’ => $password,
                    ‘name’ => $webUser->name ?? $username,
]);

Benefits Summary

 ✅ Seamless UX  – Users stay on Laravel, login to WP happens invisibly
🚫 No Redirects  – No jarring redirects or loading delays
🔒 Secure  –  HMAC + short-lived tokens keep it safe |
💡 Easy Maintenance
🌐 Cross-subdomain friendly – Works between subdomains with proper SameSite & Secure cookie setup

Ideal Use Case

Use iframe SSO when:

– Both Laravel & WordPress are on subdomains.
– You want a clean, instant SSO experience.
– You have control over both systems.
– You want to avoid third-party SSO packages.

Final Thoughts

Implementing auto-login from Laravel to WordPress using an <iframe> is simple, secure, and user-friendly. This approach is perfect for developers who need lightweight SSO without the complexity of full OAuth stacks or third-party services.

Empower your users with a truly seamless experience — login once, access everything.