How to prevent caching login credentials?

  • Resolved typeless

    (@jbalyo)


    3 weeks, 6 days ago

    I have a site where subscriber login credentials are often changed directly in the database by way of a custom procedure. I’ve noticed that since switching to Breeze for caching on Cloudways, login credentials updated in this way do not take effect until Breeze cache is completely cleared. However, changing a password through the WordPress Profile page does update the password immediately.

    It seems that Breeze is caching database query results including login credentials. This presents some security implications, as urgent password changes may not naturally take effect for hours or days. I don’t see any setting to prevent credential caching or even database caching entirely (if nothing more granular is available). How can we prevent this from happening? Obviously there must be some method for NOT caching old credentials since passwords updated through the Profile page do not get cached in the same way.

    Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author owaisalam

    (@owaisalam)

    Could you please share the custom procedure you’re using for changing passwords?

    Additionally, please note that the “Never Cache URL” option under the Advanced Options tab excludes the entire URL from the Breeze cache. However, Breeze does not cache sensitive information, such as user credentials or My Account details. Understanding your specific procedure for changing passwords would help us provide more tailored guidance.

    Thread Starter typeless

    (@jbalyo)

    @owaisalam It utilizes the WPDB Update function like so:

    $wpdb->update($wpdb->prefix."users", ['user_pass'=>$wp_hasher->HashPassword($new_pass)], ['ID'=>$user->id]);

    If Breeze does not cache user credentials, why after changing a password this way does the old password continues to work (and the new one does not work) until the Breeze cache has been cleared? Could it be getting stuck in CDN (Cloudflare)?

    Or another way to approach it – is there possibly a way to trigger a Breeze cache clearing with code at the same time we make the Update?

    Hi @jbalyo ,

    Thanks for reaching out.

    We have a action hook do_action( 'breeze_clear_all_cache' ) that can be used to clear the cache.

    Breeze do not cache the login related requests and pages.
    It seems like you are using some custom setup for user registration and login that is causing the breeze to cache these requests. To debug the exact issue in your setup
    we may need some additional information you can reach out to us at Breeze Support.

    Regards,

    Jawad

    Thread Starter typeless

    (@jbalyo)

    Thank you @jawadwp . That in combination with wp_cache_flush() did the trick.

Viewing 4 replies - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.