WC_Shortcode_My_Account::create_password_reset_bridge_token │ public static │ WC 11.2.0

Create a short-lived random handle that bridges a valid reset link across a redirect.

Only a keyed digest of the handle and a verifier for WordPress's current hashed reset state are stored. The handle is consumed when it is exchanged for a separate signed form token, so the rendered page URL is not a reusable password-reset credential.

Method of the class: WC_Shortcode_My_Account{}

No Hooks.

Returns

string. Random bridge handle, or an empty string when no reset state exists.

Usage

$result = WC_Shortcode_My_Account::create_password_reset_bridge_token( $user );

$user(WP_User|WP_Error|null) (required)

User with an active WordPress password-reset key. Anything else yields an empty handle, so callers can pass the raw result of check_password_reset_key().

Changelog

WC_Shortcode_My_Account::create_password_reset_bridge_token() WC Shortcode My Account::create password reset bridge token code ^{WC 11.2.1}

public static function create_password_reset_bridge_token( $user ) {
	if ( ! $user instanceof WP_User || empty( $user->user_activation_key ) ) {
		return '';
	}

	$now        = time();
	$expiration = min( $now + self::PASSWORD_RESET_BRIDGE_EXPIRATION, self::get_password_reset_state_expiration( $user ) );
	if ( $expiration <= $now ) {
		return '';
	}

	$payload = array(
		'user_id'         => $user->ID,
		'expiration'      => $expiration,
		'state_signature' => self::get_password_reset_state_signature( $user ),
	);

	for ( $attempt = 0; $attempt < 3; $attempt++ ) {
		$handle         = wp_generate_password( self::PASSWORD_RESET_BRIDGE_HANDLE_LENGTH, false, false );
		$transient_name = self::get_password_reset_bridge_transient_name( $handle );

		if ( false !== get_transient( $transient_name ) ) {
			continue;
		}

		if ( set_transient( $transient_name, $payload, $expiration - $now ) ) {
			return $handle;
		}
	}

	wc_get_logger()->warning( 'Password reset bridge could not be stored; falling back to the cookie-only flow.', array( 'source' => 'password-reset' ) );

	return '';
}