[ Index ]

PHP Cross Reference of WordPress Trunk (Updated Daily)

Search

title

Body

[close]

/wp-includes/secrets/ -> class-wp-secrets-config-key-provider.php (summary)

Secrets API: WP_Secrets_Config_Key_Provider class

File Size: 311 lines (9 kb)
Included or required:0 times
Referenced: 0 times
Includes or requires: 0 files

Defines 8 functions

  __construct()
  wrap()
  unwrap()
  get_key_source()
  get_site_key()
  are_usable_salt_values()
  is_canonical_base64_32()
  decode_canonical_base64_32()

Functions
Functions that are not part of a class:

__construct( bool $use_previous_key = false )   X-Ref
Constructor.

param: bool $use_previous_key Derive from WP_SECRETS_KEY_PREVIOUS rather than

wrap( string $key_material )   X-Ref
Wraps raw key material under the derived site key.

return: string|WP_Error
param: string $key_material Raw key material to protect.

unwrap( string $wrapped )   X-Ref
Unwraps key material previously wrapped by wrap().

return: string|WP_Error
param: string $wrapped An opaque value previously returned by wrap().

get_key_source()   X-Ref
Describes the active key source, for Site Health.

return: string

get_site_key()   X-Ref
Derives the 32-byte site key per the priority rules documented on this class.

return: string|WP_Error

are_usable_salt_values( $logged_in_key, $logged_in_salt )   X-Ref
Whether a pair of candidate salt values are usable as key material.

Both must be non-empty strings, and neither may be the literal
wp-config-sample.php placeholder – which every unconfigured install shares,
making it a publicly known value rather than a secret.

Takes explicit arguments rather than reading LOGGED_IN_KEY/LOGGED_IN_SALT
directly so the decision logic is testable without touching real constants,
which – once WordPress has bootstrapped once in a process – can never be
redefined to a different value for a test.

return: bool
param: mixed $logged_in_key  Candidate value of LOGGED_IN_KEY, or null if undefined.
param: mixed $logged_in_salt Candidate value of LOGGED_IN_SALT, or null if undefined.

is_canonical_base64_32( $value )   X-Ref
Whether $value is the canonical base64 encoding of exactly 32 bytes.

Uses strict-mode decoding plus a re-encode comparison, rather than a bare
base64_decode(), so that a malformed or non-canonically-padded constant falls
through to the legacy (hashed) interpretation instead of being silently
accepted as 32 bytes of something else.

return: bool
param: mixed $value Candidate value.

decode_canonical_base64_32( $value )   X-Ref
Decodes $value if it is the canonical base64 encoding of exactly 32 bytes.

return: string|null The 32 decoded bytes, or null if $value is anything else.
param: mixed $value Candidate value.



Generated : Wed Oct 14 08:20:33 2026 Cross-referenced by PHPXref