http://bbpress.org/forums/ bbPress support forums Tag: secret en Thu, 20 Nov 2008 16:11:49 +0000 http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-19557 Tue, 30 Sep 2008 00:58:08 +0000 chrishajer 19557@http://bbpress.org/forums/ <p>Norvu, those version are incompatible. You <strong>don't</strong> integrate the cookies. If you want integrated logins, you need to use bbPress 0.9.* with WordPress 2.5 or bbPress Alpha with WordPress 2.6.</p> <p><a href="http://bbpress.org/forums/topic/wordpress-and-bbpress-integration-101#post-17409" rel="nofollow">http://bbpress.org/forums/topic/wordpress-and-bbpress-integration-101#post-17409</a> </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-19555 Mon, 29 Sep 2008 21:03:27 +0000 Norvu 19555@http://bbpress.org/forums/ <p>WordPress version 2.6.2 and bbPress version 0.9.0.2 </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-19548 Mon, 29 Sep 2008 14:28:16 +0000 chrishajer 19548@http://bbpress.org/forums/ <p>Norvu - what versions of bbPress and WordPress are you using? </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-19539 Mon, 29 Sep 2008 00:05:20 +0000 Norvu 19539@http://bbpress.org/forums/ <p>So how does one integrate the cookies? </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-19079 Mon, 08 Sep 2008 15:40:46 +0000 _ck_ 19079@http://bbpress.org/forums/ <p>Note that WP 2.5 / bbPress 0.9 uses a SINGLE key</p> <p>WP 2.6 / bbPress 1.0 uses THREE different keys </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-19059 Sun, 07 Sep 2008 23:15:42 +0000 mrosenau 19059@http://bbpress.org/forums/ <p>You go here to get your "secret key" (there's three of them. <a href="http://api.wordpress.org/secret-key/1.1/" rel="nofollow">http://api.wordpress.org/secret-key/1.1/</a></p> <p>define('AUTH_KEY', ...<br /> define('SECURE_AUTH_KEY', ...<br /> define('LOGGED_IN_KEY', ...</p> <p>you place these in your wordpress wp-config.php file where the empty one were.</p> <p>Then you post the keys inside the secret key box in the bb press installation wizard. </p> <p>Or if you missed that part and your putting it directly into your bb-config.php file </p> <p>you replace: define('BB_SECRET_KEY', ...<br /> and everything after in on that LINE. </p> <p>with: your three secret keys.</p> <p>and that should fix everything, ...that is if you have all your other wordpress - bbpress integration stuff lined up correctly :) </p> http://bbpress.org/forums/topic/so-many-secrets#post-18978 Fri, 05 Sep 2008 18:30:11 +0000 _ck_ 18978@http://bbpress.org/forums/ <p>The cookies in bbPress 1.0 and WordPress 2.6 are based on recommendations from a security whitepaper by a top researcher.</p> <p>Half of the key used in the cookie is kept in the database and the other half of the key is kept in the configuration file (bb-config.php / wp-config.php) </p> <p>The idea is to make it harder for an attacker to compromise the system. They may gain file access but not db access or visa versa - therefore the other half is safe.</p> <p>When I say "half" it's not literal - but essentially the secret keys are "salted" with the secret salt. "Salting" is a much more complex operation than needs to be explained here (see wikipedia). </p> http://bbpress.org/forums/topic/so-many-secrets#post-18962 Fri, 05 Sep 2008 12:17:00 +0000 flywitness 18962@http://bbpress.org/forums/ <p>thanks for making the effort, but thats not what i asked. </p> http://bbpress.org/forums/topic/so-many-secrets#post-18958 Fri, 05 Sep 2008 11:37:32 +0000 cartmanffc 18958@http://bbpress.org/forums/ <p>necessary for WP 2.6 -&gt; BBP 1alpha:<br /> WordPress "auth" cookie key<br /> WordPress "secure auth" cookie key<br /> WordPress "logged in" cookie key </p> http://bbpress.org/forums/topic/so-many-secrets#post-18957 Fri, 05 Sep 2008 11:12:56 +0000 flywitness 18957@http://bbpress.org/forums/ <p>BB_SECRET_KEY</p> <p>BB_SECRET_SALT</p> <p>(database) secret</p> <p>whats the difference? what needs to match what for wp integration?<br /> can we have some or one without the other? i'm confused.</p> <p>WP 2.6 -&gt; BBP 1alpha </p> http://bbpress.org/forums/topic/cannot-change-secret-field#post-17653 Fri, 25 Jul 2008 17:40:54 +0000 _ck_ 17653@http://bbpress.org/forums/ <p>Glad to hear it worked - remember to not keep using <code>$bb-&gt;secret</code> though in your config and update the db properly as it lowers the security of your setup somewhat.</p> <p>(The idea being an attacker might gain access to bb-config.php and not your db to gain the second half of the key - not my design and not sure I agree with the logic but I guess it's still better than keep both in an obvious place) </p> http://bbpress.org/forums/topic/cannot-change-secret-field#post-17640 Fri, 25 Jul 2008 09:00:22 +0000 Anonymous 17640@http://bbpress.org/forums/ <p>_ck_ That worked!!!! Thank you so much!!!</p> <p>chrishajer<br /> I don't have access to my client's hosting plus I'm not very familiar with Plesk to guide him without looking at it myself.</p> <p>Anyhow, the problem has been solved :))</p> <p>On a sidenote: This forum keeps telling me my username does not exist when I try going to my profile or favourites :-o </p> http://bbpress.org/forums/topic/cannot-change-secret-field#post-17638 Fri, 25 Jul 2008 07:02:58 +0000 _ck_ 17638@http://bbpress.org/forums/ <p>It might be possible to do this inside bb-config.php</p> <p>$bb-&gt;secret="blah blah your key";</p> <p>and override the internal db.</p> <p>I have to lookup if "secret" is the real name though.</p> <p>(that's in addition to define('BB_SECRET_KEY' )</p> <p>Yeah, apparently it really is <code>$bb-&gt;secret</code> give that a try. </p> http://bbpress.org/forums/topic/cannot-change-secret-field#post-17637 Fri, 25 Jul 2008 07:01:40 +0000 chrishajer 17637@http://bbpress.org/forums/ <p>Thanks _ck_ </p> http://bbpress.org/forums/topic/cannot-change-secret-field#post-17635 Fri, 25 Jul 2008 06:56:35 +0000 _ck_ 17635@http://bbpress.org/forums/ <p>hmm - have to think about that one</p> <p>chris, there are two parts to the key, you can't define the other part via the bb-config.php</p> <p>actually - have you tried completely clearing your cookies? Even with a mismatched key you should be able to login, just not sync with wordpress. The cookies might be scrambled until you clear them. </p> http://bbpress.org/forums/topic/cannot-change-secret-field#post-17634 Fri, 25 Jul 2008 06:55:47 +0000 chrishajer 17634@http://bbpress.org/forums/ <p>How about just putting the correct value in bb-config.php?<br /> <code>define(&#39;BB_SECRET_KEY&#39;,</code><br /> &nbsp;<br /> Just make that the same as the value in wp-config.php</p> <p>There's no way in Plesk to manage the database? That seems odd. Do you have shell access where you could use mysql from the command line? </p> http://bbpress.org/forums/topic/cannot-change-secret-field#post-17630 Fri, 25 Jul 2008 06:16:37 +0000 Anonymous 17630@http://bbpress.org/forums/ <p>Hi,</p> <p>I entered the wrong Secret value when installing BBPress. Now when I go to BBPress Settings &gt; Wordpress Integration and try to change it, it logs me out of BBPress. The value obviously does not get updated. This only hapens if I try to change the Secret field.</p> <p>How do I update the field as WP integration will not work otherwise? I don't have direct access to the database, no PHPmyadmin option. My client is using PLESK.</p> <p>Thanks! </p> http://bbpress.org/forums/topic/cookie-problem-logging-in-to-bbpress-logs-out-of-wp-and-vice-versa#post-16407 Thu, 22 May 2008 21:15:33 +0000 tbaleno 16407@http://bbpress.org/forums/ <p>Well, having checked and rechecked everything, it turns out it was that the secret in wp-admin/options.php was different than the secret in the wp integration settings in bbpress.</p> <p>I had checked these before and they were identical, but at the time I might have been dealing with a path issue. Then when the path issue was resolved I never went back to ensure they were still the same. </p> <p>My suggestion to everyone is to check everything even if you KNOW you check them before. </p> http://bbpress.org/forums/topic/cookie-problem-logging-in-to-bbpress-logs-out-of-wp-and-vice-versa#post-16384 Thu, 22 May 2008 03:31:08 +0000 tbaleno 16384@http://bbpress.org/forums/ <p>Those solutions did't work. </p> <p>I just upgraded wordpress to 2.5.1 and still no luck. </p> http://bbpress.org/forums/topic/cookie-problem-logging-in-to-bbpress-logs-out-of-wp-and-vice-versa#post-16365 Wed, 21 May 2008 05:52:37 +0000 mrhoratio 16365@http://bbpress.org/forums/ <p>This has been discussed in a previous thread:</p> <p><a href="http://bbpress.org/forums/topic/new-login-required-when-between-bbpress-and-wordpress" rel="nofollow">http://bbpress.org/forums/topic/new-login-required-when-between-bbpress-and-wordpress</a> </p> http://bbpress.org/forums/topic/cookie-problem-logging-in-to-bbpress-logs-out-of-wp-and-vice-versa#post-16339 Mon, 19 May 2008 23:50:00 +0000 tbaleno 16339@http://bbpress.org/forums/ <p>2.5 and 0.9.0.2 </p> http://bbpress.org/forums/topic/cookie-problem-logging-in-to-bbpress-logs-out-of-wp-and-vice-versa#post-16311 Mon, 19 May 2008 11:52:39 +0000 sambauers 16311@http://bbpress.org/forums/ <p>What versions of each are you running? </p> http://bbpress.org/forums/topic/cookie-problem-logging-in-to-bbpress-logs-out-of-wp-and-vice-versa#post-16297 Sun, 18 May 2008 02:11:58 +0000 tbaleno 16297@http://bbpress.org/forums/ <p>update: Everything in the cookie (when looking at it in firefox) seems identical except the content section and the expire time.</p> <p>The content section has the user name, but the two numbers after it are different. </p> http://bbpress.org/forums/topic/cookie-problem-logging-in-to-bbpress-logs-out-of-wp-and-vice-versa#post-16296 Sun, 18 May 2008 00:33:15 +0000 tbaleno 16296@http://bbpress.org/forums/ <p>So when I log in to one of them the other gets logged out. I'm sure this is because they are sharing the same cookie, but the info in the cookie is different. </p> <p>What did I do wrong?</p> <p>My site is <a href="http://www.mysimplehomegarden.com/garden" rel="nofollow">http://www.mysimplehomegarden.com/garden</a></p> <p>the forum is <a href="http://www.mysimplehomegarden.com/garden/bbpress" rel="nofollow">http://www.mysimplehomegarden.com/garden/bbpress</a> </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-15143 Tue, 08 Apr 2008 14:00:27 +0000 RyanNutt 15143@http://bbpress.org/forums/ <p>When I added the key to wp-config it wouldn't let me login into the wp admin either. What I had done was put the define() line at the end thinking that would work. I moved it up under the other define() line instead of the very end and the permissions problem went away. </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-15128 Tue, 08 Apr 2008 05:22:49 +0000 sambauers 15128@http://bbpress.org/forums/ <p>You need to create the Secret Key in your WordPress config.</p> <p>Read the WordPress Codex for more info.</p> <p><a href="http://codex.wordpress.org/Editing_wp-config.php#Secret_key_for_salting_password" rel="nofollow">http://codex.wordpress.org/Editing_wp-config.php#Secret_key_for_salting_password</a> </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-15113 Mon, 07 Apr 2008 19:15:27 +0000 snoon 15113@http://bbpress.org/forums/ <p>I don't have one either. And I am totally perplexed as to where you found documentation about creating one. My wp-config has no such animal and my bbpress install is blocked. I'm stopped until I get my mind around this one. HELP!</p> <p>Scott<br /> <a href="mailto:scott@scottnoon.com">scott@scottnoon.com</a> </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-14984 Thu, 03 Apr 2008 23:11:52 +0000 lostdeviant 14984@http://bbpress.org/forums/ <p>my question is what happens to bbPress when I remove the key from wp-config? </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-14983 Thu, 03 Apr 2008 23:01:36 +0000 lostdeviant 14983@http://bbpress.org/forums/ <p>FYI - I tried creating a secret-key according to what I read which lets me finish the install of bbPress however when I try to log in to wordpress I can't. In fact, I get a message saying that I don't have permissions!</p> <p>When I remove my invented secret key, I can login like normal... </p> http://bbpress.org/forums/topic/wordpress-cookie-secret-key-why-dont-i-have-one#post-14976 Thu, 03 Apr 2008 20:56:20 +0000 lostdeviant 14976@http://bbpress.org/forums/ <p>I just went to add a bbpress forum to a site I upgraded from 2.3.3 to 2.5. On step 2 of the bbpress install, it requests a "cookie secret key" which is supposedly in my wp-config. </p> <p>I don't see a secret key there so what am I supposed to do?</p> <p>"This value must match the value of the constant named "SECRET_KEY" in your WordPress wp-config.php file. This will replace the bbPress cookie secret key set in the first step." </p>