About this plugin
Auto Login for Sakura Rental Server allows administrators to issue one-time, time-limited auto-login URLs using HMAC signatures.
This is useful for secure temporary access or system integration.
Features:
– Secure auto-login with one-time tokens
– Tokens are HMAC-signed and invalidated after use
– Token issuance and usage history (up to 100 entries per user)
– Records IP address and username of the issuer
– Rate limiting: 1 request per second per IP
– WP-CLI commands for token generation and history inspection
Example use cases:
– Temporarily granting admin access
– Safe automatic login from external systems
– Keeping an audit log of who issued a token and from where
Usage
Generate a token via CLI
wp auto-login-for-sakura-rental-server generate <user_id> [–expires=] [–remote_addr=] [–username=]
Example:
- Default expiration time: 300 seconds
- --expires and --username are optional
Check issue history
Token history is stored in the user meta key sakura_auto_login_history.
You can check it via WP-CLI:
wp user meta get sakura_auto_login_history
Auto-login URL format
rs_auto_login_token=<64-character HMAC token>
Visiting the URL will log in as the corresponding user and redirect to the admin dashboard.
Security Notes
- Tokens are invalidated immediately after use (one-time only)
- Issue and usage history includes IP address, issuer username, and timestamps
- Stored using update_option() for caching compatibility
- HTTPS is strongly recommended