use user_id rather than user_login in the authentication cookie

[Denis-de-Bernardy]

suggested enhancement:

• prevent username from matching /d+/
• use user_id, instead of user_login, in the authentication cookie

[Denis-de-Bernardy]

this one might be worth a discussion in wp-hackers. it is meant to prevent the username to be passed in the cookie.

it *might* break a plugin or two that relies on the auth_cookie_bad_username hook. we could alternatively keep that hook's name unchanged, but the semantics would wrong. or we could fire both auth_cookie_bad_username *and* auth_cookie_bad_user_id, passing the user_id each time -- to ensure 100% backwards compat.

[ryan]

I think we went with username instead of ID in the cookie because we expose usernames in so many other places that isn't really very private.

[Denis-de-Bernardy]

Sounds reasonable. It *could* be an issue when the username is an email, though. ;-)

[Denis-de-Bernardy]

see also: #9568

[Denis-de-Bernardy]

refreshed against 11256

[ryan]

Since you took care of the email case in your other patch, I'd like to say wontfix on this one.

[Denis-de-Bernardy]

actually, the user_nicename and the cookie are separate issues.

the cookie currently contains the user_login, rather than the user_nicename. I could change the patch to use the user_nicename if you think it's preferrable.

[Denis-de-Bernardy]

still applies clean, but delaying this until we get the log in using email address thingy done. else, it makes no sense to get this into WP.

[Denis-de-Bernardy]

closing this, based on westi's suggestion in the #9568