rpress_get_user_verification_token_secret

Filters the secret mixed into user verification tokens.

Runs in rpress_get_user_verification_token(). The default is the configured hash algorithm applied to wp_salt(). The secret is added to the URL as the secret query argument before the token is computed, so it is never included in the emailed link.

Parameters#

Parameter	Type	Description
$secret	string	The default secret derived from wp_salt().

Return value#

string. The secret used when generating and checking tokens.

Example#

function my_verification_token_secret( $secret ) {
	return hash( 'sha256', $secret . wp_salt( 'auth' ) );
}
add_filter( 'rpress_get_user_verification_token_secret', 'my_verification_token_secret' );

Notes#

Tokens are regenerated on validation, so the same filter must return the same value on both requests. Changing it invalidates links already sent.

Source#

Applied in:

• includes/user-functions.php (line 715), in rpress_get_user_verification_token()

See also#

• rpress_get_user_verification_token_algorithm