This exactly shows how broken and badly designed wordpress is. I login in to wordpress using user A. User A creates new site. WordPress creates sample page owned by user B.

WTF!

Everyone already knows that their logged-in sessions seem to exist forever (AI confirms this [1]). The next day, when your computer wakes from hibernation, you can just continue where you left off in WordPress. Obviously I was expecting this to be corrected by the OIDC/Keycloak plugin I found, but that was too much of an expectation.

Not really ideal if you want to have a bit more security. I don’t really get what goes on in the brains of these WordPress (core) developers to always deviate from known best practices.

Anyway, luckily, with the help of a local Qwen 3.8, it is now much easier and quicker to adapt code. The logged-in session timeout is now driven by Keycloak’s refresh_expires_in value from the token response (the realm’s SSO session lifetime — 30 min / 1800 s in your config).

An example of how nice single sign on can be, just logging in with fido2 compatible security key.

[1]Local llm (qwen3.8) confirmation of WordPress’s implementation

Prompt:

## tool use

You can test yourself using the curl_get tool with arguments url: http://192.168.3.11/wordpress-multi/wp-admin/network/settings.php and strip: ["meta","link","style","script","comments","tagclasses"]. For instance if you need to see html forms omit "body-forms".

and then see the error_log with the cmd_tail tool

Extra information is available in Qdrant memory collection_name "php8.2-stubs", "wordpress-stubs", "wordpress".

Collections related to rfc related to oicd/oauth "rfc7515-jws","rfc7517-jwk","rfc7519-jwt","rfc7636-pkce"

Changes you made you can see with the git_status and the git_diff tool, don't use the git_diff_unstaged. Always include with git_* calls the argument repo_path: /daggerhart-openid-connect-generic


## the issue and your assignment

can you give the default users logged in timeout of wordpress and a snippet of the code that confirms this.

WordPress default login timeout

WordPress doesn’t have a single “timeout” — session length depends on whether “Remember me” was checked at login, and it’s controlled by the auth cookie expiration in wp_set_auth_cookie() (wp-includes/pluggable.php):

Login mode	Default expiration
✅ “Remember me” checked	14 days (14 * DAY_IN_SECONDS)
❌ Not checked (default)	2 days (2 * DAY_IN_SECONDS)

Both values are filterable via the auth_cookie_expiration hook. The 2-day figure is also confirmed by the wordpress-stubs collection docblock on wp_set_auth_cookie:

“If false, the cookie is a browser session cookie… Internally, auth_cookie_expiration is still applied, to expire the login after two days or when the browser is closed, whichever occurs first.”

Code snippet (from wp-includes/pluggable.php, per Qdrant wordpress collection)

function wp_set_auth_cookie( $user_id, $remember = false, $secure = '', $token = '' ) {
	if ( $remember ) {
		// "Remember me" checked → default 14 days
		$expiration = time() + apply_filters( 'auth_cookie_expiration', 14 * DAY_IN_SECONDS, $user_id, $remember );

		/*
		 * Ensure the browser will continue to send the cookie after the
		 * expiration time is reached. Needed for the login grace period
		 * in wp_validate_auth_cookie().
		 */
		$expire = $expiration + ( 12 * HOUR_IN_SECONDS );
	} else {
		// "Remember me" not checked → default 2 days
		$expiration = time() + apply_filters( 'auth_cookie_expiration', 2 * DAY_IN_SECONDS, $user_id, $remember );
	}
    // ...
}

Bonus: grace periods that extend effective login time

Even after expiration, WordPress allows a grace period before invalidating the session — relevant if you’re designing your OIDC/OAuth bridge:

1. In wp_validate_auth_cookie() (wp-includes/pluggable.php):

	$expired = (int) $expiration;

	// Allow a grace period for POST and Ajax requests.
	if ( wp_doing_ajax() || 'POST' === $_SERVER['REQUEST_METHOD'] ) {
		$expired += HOUR_IN_SECONDS;   // +1 h grace period
	}

	// Quick check to see if an honest cookie has expired.
	if ( $expired < time() ) {
		do_action( 'auth_cookie_expired', $cookie_elements );
		return false;
	}

2. The 12-hour cookie-persistence buffer in the $expire = $expiration + (12 * HOUR_IN_SECONDS) line (so browsers keep sending the cookie a bit past expiration).

Bottom line: by default a user without “Remember me” stays logged in for 2 days, and 14 days with it — unless a plugin (or the auth_cookie_expiration filter in your daggerhart-openid-connect-generic plugin) changes it.

12:07