About this plugin
0 / OpenID Connect — self-contained, with no third-party plugins or intermediary services. Customer credentials never pass through the store: authentication happens at Google/Microsoft and the plugin only cryptographically validates the result.
Features
- Two providers, one architecture — every provider-specific fact (endpoints, claim policy, branding) lives in a single registry; the rest of the code is provider-agnostic. Adding a third provider is adding one registry entry.
- Automatic account creation — the first login creates a WooCommerce customer (role customer ) with a strong random password.
- Secure linking of existing accounts — if the email already has a store account, the plugin does not log in directly: it asks for the password once to prove ownership, and only then links the external identity (prevents account takeover by email).
- The same email on both providers lands on the same WP account — linked identities are stored in distinct per-provider meta.
- Full id_token validation — signature against the provider’s JWKS (with cache), iss, aud, exp, nonce, and per-provider email_verified policy.
- CSRF protection — single-use state + nonce in a transient with an HttpOnly / SameSite=Lax cookie.
- Secrets outside the database (optional, recommended) — constants in wp-config.php take priority and lock the admin field.
- Organized admin — page under WooCommerce → Social Login with per-provider tabs, a step-by-step guide with deep links to the consoles, a ready-to-copy Redirect URI, and live status.
- Accessible, responsive buttons — side by side when there’s width, stacked when there isn’t; short labels with full aria-label; light/dark themes.
- No runtime dependencies beyond firebase/php-jwt (vendored in the repo — the plugin installs by copy, with no composer install ).
How it works
The customer authenticates at the provider (the store never sees the password); the plugin verifies the signed id_token (JWKS), validates the claims ( iss / aud / exp / nonce / email), and resolves the account:
- Identity already linked ( sub known) → immediate login
- New email → creates a WooCommerce customer + links the identity + login
- Email already exists, no linked identity → asks for password login once and links on success
- Email not verified at the provider → rejected with a message to the customer
External services
This plugin is an interface to the sign-in services of Google and Microsoft. It contacts them only when you, the site administrator, enable and configure a provider, and only while a visitor is actively signing in with that provider. There is no telemetry, no analytics, and no data is ever sent to PixelHunter or to any other third party.
Google Sign-In (used only when the Google provider is enabled)
- accounts.google.com — the visitor’s browser is redirected here to sign in. The request carries the Client ID you configured, the redirect URI of your site, the requested scopes ( openid email profile ), and a single-use state / nonce. The visitor enters their credentials at Google; the store never sees them.
- oauth2.googleapis.com — server-to-server exchange of the authorization code for an id_token. Sends the Client ID, the Client Secret, the authorization code, and the redirect URI.
- www.googleapis.com — fetches Google’s public signing keys (JWKS) to verify the id_token signature. No site or visitor data is sent; the response is cached.
Data received back from Google and stored on your site: the account identifier ( sub ), email address, name, and the email_verified flag. The sub is stored as user meta so the account can be recognised on the next sign-in.
com/privacy
Microsoft identity platform (used only when the Microsoft provider is enabled)
- login.microsoftonline.com — the same three roles as above (visitor sign-in redirect, code-for-token exchange, and JWKS key fetch), against the consumers tenant for personal Microsoft accounts.
Data received back from Microsoft and stored on your site: the account identifier ( sub ), email address, and name.
com/privacystatement