Question

I’m using a custom login form, the same as the one in wp-admin, the form action is in the same page stated as follow:

if($_POST){
    //We shall SQL escape all inputs
    $username = $wpdb->escape($_REQUEST['username']);
    $password = $wpdb->escape($_REQUEST['password']);
    $remember = $wpdb->escape($_REQUEST['rememberme']);
    $redirect = $wpdb->escape($_REQUEST['redirect_to']);

    if($redirect == ''){$redirect= get_bloginfo('home').'/start/?login=true';}

    if($remember){$remember = "true";}
    else {$remember = "false";}

    $login_data = array();
    $login_data['user_login'] = $username;
    $login_data['user_password'] = $password;
    $login_data['remember'] = $remember;
    $user_verify = wp_signon( $login_data, true ); 
}

The user logs in successfully, however when the user points to the wp-admin folder, he’s asked to log in again using the original wordpress login form, I noticed reauth=1 in the title of the wp-login page. How can I log the user in using a custom login form the right way ?

Answer 1

Try adding wp_set_auth_cookie() function to your script. This sets the authentication cookie for users to seamlessly access the WordPress dashboard.

wp_set_auth_cookie($user_data->ID);