內容簡介
⚠️ 重要提示：此外掛已合併至 WordPress 5.6 核心，不需要單獨安裝。 查看整合指南→
使用應用程式密碼進行身份驗證，而不必直接提供用戶的密碼。相反，為每個應用程式生成唯一的密碼，而不洩露用戶的主要密碼。每個應用程式的應用程式密碼都可以單獨撤銷。
重要提示：只能用於驗證 API 請求，例如REST API和XML-RPC，而不能用於常規網站登錄。
貢獻
將外掛程式翻譯成您的語言。
在 GitHub上報告問題，提出功能建議和貢獻代碼。
手動創建應用程式密碼
進入要為其生成新應用程式密碼的用戶的“使用者資料”頁面。要這樣做，點擊 WordPress 管理員左側的“使用者”，然後點擊您要管理的用戶。
向下滾動，直到看到“應用程式密碼”部分。這通常在頁面底部。
在輸入欄中，輸入新應用程式密碼的名稱，然後點擊“新增”。
注意：“應用程式密碼名稱”僅用於描述您的密碼以便日後輕鬆管理。它不會以任何方式影響您的密碼。如果您稍後需要更改密碼，這樣做會使管理變得更加容易和方便。
單擊“新增”按鈕後，您的新應用程式密碼將顯示。請將其保存在安全的位置，因為不會再顯示給您。如果您丟失此密碼，將無法再獲取它。
雙因素驗證支援
只要您繞過雙因素外掛添加的API訪問限制，應用程式密碼就可以與雙因素外掛一起使用。這些保護措施禁用啟用雙因素驗證的用戶的通過密碼身份驗證的API請求。
使用 two_factor_user_api_login_enable 過濾器允許使用應用程式密碼進行API請求身份驗證：
add_filter( 'two_factor_user_api_login_enable', function( $enable ) {
// Allow API login when using an application password even with 2fa enabled.
if ( did_action( 'application_password_did_authenticate' ) ) {
return true;
}
return $enable;
} );
如果與應用程式密碼關聯的用戶沒有啟用任何雙因素方法，則不需要執行此操作。
請求應用程式密碼
要為應用程序請求密碼，請重定向用戶到：
https://example.com/wp-admin/admin.php?page=auth_app
並使用以下GET請求參數進行指定：
app_name（必需） - 應用程式的人類可讀取識別符。這將是生成的應用程式密碼的名稱，因此請像“iPhone 12 上的WordPress移動應用程序”一樣結構化，以實現多個版本之間的唯一性。如果省略，則需要用戶提供應用程式名稱。
success_url（建議）表達頁面的URL，當生成應用程式密碼時，或是用戶通過應用程式密碼登錄時，它將被使用。
外掛標籤
開發者團隊
原文外掛簡介
⚠️ IMPORTANT: This plugin has been merged into WordPress core version 5.6 and doesn’t have to be installed separately. View the integration guide →
Use Application Passwords to authenticate users without providing their passwords directly. Instead, a unique password is generated for each application without revealing the user’s main password. Application passwords can be revoked for each application individually.
Important: Application Passwords can be used only for authenticating API requests such as REST API and XML-RPC, and they won’t work for regular site logins.
Contribute
Translate the plugin into your language.
Report issues, suggest features and contribute code on GitHub.
Creating Application Password Manually
Go the User Profile page of the user that you want to generate a new application password for. To do so, click Users on the left side of the WordPress admin, then click on the user that you want to manage.
Scroll down until you see the Application Passwords section. This is typically at the bottom of the page.
Within the input field, type in a name for your new application password, then click Add New.
Note: The application password name is only used to describe your password for easy management later. It will not affect your password in any way. Be descriptive, as it will lead to easier management if you ever need to change it later.
Once the Add New button is clicked, your new application password will appear. Be sure to keep this somewhere safe, as it will not be displayed to you again. If you lose this password, it cannot be obtained again.
Two Factor Support
Application Passwords can be used together with the Two Factor plugin as long as you bypass the API acccess restrictions added by the Two Factor plugin. Those protections disable API requests with password authentication for users with Two Factor enabled.
Use the two_factor_user_api_login_enable filter to allow API requests authenticated using an application passwords:
add_filter( 'two_factor_user_api_login_enable', function( $enable ) {
// Allow API login when using an application password even with 2fa enabled.
if ( did_action( 'application_password_did_authenticate' ) ) {
return true;
}
return $enable;
} );
This is not required if the user associated with the application password doesn’t have any of the Two Factor methods enabled.
Requesting Password for Application
To request a password for your application, redirect users to:
https://example.com/wp-admin/admin.php?page=auth_app
and use the following GET request parameters to specify:
app_name (required) – The human readable identifier for your app. This will be the name of the generated application password, so structure it like … “WordPress Mobile App on iPhone 12” for uniqueness between multiple versions. If omitted, the user will be required to provide an application name.
success_url (recommended) – The URL that you’d like the user to be sent to if they approve the connection. Two GET variables will be appended when they are passed back — user_login and password — these credentials can then be used for API calls. If the success_url variable is omitted, a password will be generated and displayed to the user, to manually enter into your application.
reject_url (optional) – If included, the user will get sent there if they reject the connection. If omitted, the user will be sent to the success_url, with ?success=false appended to the end. If the success_url is omitted, the user will be sent to their dashboard.
Testing an Application Password
We use curl to send HTTP requests to the API endpoints in the examples below.
WordPress REST API
Make a REST API call to update a post. Because you are performing a POST request, you will need to authorize the request using your newly created base64 encoded access token. If authorized correctly, you will see the post title update to “New Title.”
curl --user "USERNAME:APPLICATION_PASSWORD" -X POST -d "title=New Title" https://LOCALHOST/wp-json/wp/v2/posts/POST_ID
When running this command, be sure to replace USERNAME and APPLICATION_PASSWORD with your credentials (curl takes care of base64 encoding and setting the Authorization header), LOCALHOST with the hostname of your WordPress installation, and POST_ID with the ID of the post that you want to edit.
XML-RPC
Unlike the WordPress REST API, XML-RPC does not require your username and password to be base64 encoded. Send an XML-RPC request to list all users:
curl -H 'Content-Type: text/xml' -d '
In the above example, replace USERNAME with your username, PASSWORD with your new application password, and LOCALHOST with the hostname of your WordPress installation. This should output a response containing all users on your site.
Plugin History
This is a feature plugin that is a spinoff of the main Two-Factor Authentication plugin.
