The Redirect URI changed. After updating, copy the new one from WooCommerce \u2192 Social Login into the Google Cloud Console and the Azure portal, or sign-in will fail. Settings and linked accounts are preserved.<\/p>","0.3.3":"
Screenshots now show as images in the plugin's "View Details" screen. No functional changes.<\/p>","0.3.2":"
Adds full plugin details (description, changelog, screenshots) to the WordPress "View Details" screen. No functional changes.<\/p>","0.3.1":"
Enables one-click updates straight from the Plugins screen via GitHub Releases.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3628865,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3628865,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3628865,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3628865,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.4.2"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3628865,"resolution":"1","location":"assets","locale":"","width":1199,"height":1008},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3628865,"resolution":"2","location":"assets","locale":"","width":1456,"height":840},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3628865,"resolution":"3","location":"assets","locale":"","width":1455,"height":840}},"screenshots":{"1":"Google and Microsoft buttons on the WooCommerce login\/register form (light and dark themes, responsive).","2":"Admin settings under WooCommerce \u2192 Social Login \u2014 Google tab with step-by-step guide, ready-to-copy Redirect URI, and live status.","3":"Admin settings \u2014 Microsoft tab (Azure setup guide and secret-expiry note)."}},"plugin_section":[],"plugin_tags":[150,602,3883,2061,286],"plugin_category":[38,45],"plugin_contributors":[273873],"plugin_business_model":[],"class_list":["post-346795","plugin","type-plugin","status-publish","hentry","plugin_tags-google","plugin_tags-login","plugin_tags-microsoft","plugin_tags-oauth","plugin_tags-woocommerce","plugin_category-authentication","plugin_category-ecommerce","plugin_contributors-pixelhunter","plugin_committers-pixelhunter"],"banners":{"banner":"https:\/\/ps.w.org\/pixelhunter-social-login\/assets\/banner-772x250.png?rev=3628865","banner_2x":"https:\/\/ps.w.org\/pixelhunter-social-login\/assets\/banner-1544x500.png?rev=3628865","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/pixelhunter-social-login\/assets\/icon-128x128.png?rev=3628865","icon_2x":"https:\/\/ps.w.org\/pixelhunter-social-login\/assets\/icon-256x256.png?rev=3628865","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/pixelhunter-social-login\/assets\/screenshot-1.png?rev=3628865","caption":"Google and Microsoft buttons on the WooCommerce login\/register form (light and dark themes, responsive)."},{"src":"https:\/\/ps.w.org\/pixelhunter-social-login\/assets\/screenshot-2.png?rev=3628865","caption":"Admin settings under WooCommerce \u2192 Social Login \u2014 Google tab with step-by-step guide, ready-to-copy Redirect URI, and live status."},{"src":"https:\/\/ps.w.org\/pixelhunter-social-login\/assets\/screenshot-3.png?rev=3628865","caption":"Admin settings \u2014 Microsoft tab (Azure setup guide and secret-expiry note)."}],"raw_content":"\n
Login and registration with Google<\/strong> and Microsoft<\/strong> (personal accounts: Hotmail, Outlook.com, Live) for WooCommerce stores, via OAuth 2.0 \/ OpenID Connect<\/strong> \u2014 self-contained, with no third-party plugins or intermediary services. Customer credentials never pass through the store: authentication happens at Google\/Microsoft and the plugin only cryptographically validates the result.<\/p>\n\n The customer authenticates at the provider<\/strong> (the store never sees the password); the plugin verifies the signed This plugin is an interface to the sign-in services of Google and Microsoft. It contacts them only when you, the site administrator, enable and configure a provider, and only while a visitor is actively signing in with that provider. There is no telemetry, no analytics, and no data is ever sent to PixelHunter or to any other third party.<\/p>\n\n Data received back from Google and stored on your site: the account identifier ( Google terms of service: https:\/\/policies.google.com\/terms \u2014 Google privacy policy: https:\/\/policies.google.com\/privacy<\/p>\n\n Data received back from Microsoft and stored on your site: the account identifier ( Microsoft services agreement: https:\/\/www.microsoft.com\/servicesagreement \u2014 Microsoft privacy statement: https:\/\/privacy.microsoft.com\/privacystatement<\/p>\n\n\n The buttons appear automatically on the WooCommerce login and register forms ( You bring your own free OAuth credentials: Google Cloud Console and\/or the Azure portal.<\/p>\n\n\n No. Authentication happens entirely at the provider. The plugin only receives and cryptographically verifies a signed The plugin does not log in directly. It requires a one-time password login to prove ownership before linking the external identity, which prevents account takeover by email address.<\/p><\/dd>\n Yes, and it's recommended. Define the constants in Google emits the Features<\/h4>\n\n
\n
customer<\/code>) with a strong random password.<\/li>\nid_token<\/code> validation<\/strong> \u2014 signature against the provider's JWKS (with cache), iss<\/code>, aud<\/code>, exp<\/code>, nonce<\/code>, and per-provider email_verified<\/code> policy.<\/li>\nstate<\/code> + nonce<\/code> in a transient with an HttpOnly<\/code>\/SameSite=Lax<\/code> cookie.<\/li>\nwp-config.php<\/code> take priority and lock the admin field.<\/li>\naria-label<\/code>; light\/dark themes.<\/li>\nfirebase\/php-jwt<\/code><\/strong> (vendored in the repo \u2014 the plugin installs by copy, with no composer install<\/code>).<\/li>\n<\/ul>\n\nHow it works<\/h4>\n\n
id_token<\/code> (JWKS), validates the claims (iss<\/code> \/ aud<\/code> \/ exp<\/code> \/ nonce<\/code> \/ email), and resolves the account:<\/p>\n\n\n
sub<\/code> known) \u2192 immediate login<\/li>\nExternal services<\/h3>\n\n
Google Sign-In (used only when the Google provider is enabled)<\/h4>\n\n
\n
accounts.google.com<\/code> \u2014 the visitor's browser is redirected here to sign in. The request carries the Client ID you configured, the redirect URI of your site, the requested scopes (openid email profile<\/code>), and a single-use state<\/code>\/nonce<\/code>. The visitor enters their credentials at Google<\/strong>; the store never sees them.<\/li>\noauth2.googleapis.com<\/code> \u2014 server-to-server exchange of the authorization code for an id_token<\/code>. Sends the Client ID, the Client Secret, the authorization code, and the redirect URI.<\/li>\nwww.googleapis.com<\/code> \u2014 fetches Google's public signing keys (JWKS) to verify the id_token<\/code> signature. No site or visitor data is sent; the response is cached.<\/li>\n<\/ul>\n\nsub<\/code>), email address, name, and the email_verified<\/code> flag. The sub<\/code> is stored as user meta so the account can be recognised on the next sign-in.<\/p>\n\nMicrosoft identity platform (used only when the Microsoft provider is enabled)<\/h4>\n\n
\n
login.microsoftonline.com<\/code> \u2014 the same three roles as above (visitor sign-in redirect, code-for-token exchange, and JWKS key fetch), against the consumers<\/code> tenant for personal Microsoft accounts.<\/li>\n<\/ul>\n\nsub<\/code>), email address, and name.<\/p>\n\n\n
vendor\/<\/code> directory is bundled \u2014 no composer install<\/code> needed.<\/li>\nwoocommerce_login_form_start<\/code> \/ woocommerce_register_form_start<\/code>). No theme changes needed.<\/p>\n\n\n
Does the store ever see the customer's Google\/Microsoft password?<\/h3><\/dt>\n
id_token<\/code>.<\/p><\/dd>\nWhat happens if the email already has an account in the store?<\/h3><\/dt>\n
Can I keep the client secrets out of the database?<\/h3><\/dt>\n
wp-config.php<\/code>; they take priority over the admin fields and lock them.<\/p><\/dd>\nWhy is the `email_verified` policy different for Microsoft?<\/h3><\/dt>\n
email_verified<\/code> claim and the plugin requires true<\/code>. Microsoft personal accounts (tenant consumers<\/code>) do not emit the claim \u2014 the email is that of the Microsoft account itself \u2014 so its absence is accepted only<\/strong> for Microsoft, and the iss<\/code> is validated against the fixed personal-accounts tenant GUID. An explicit email_verified=false<\/code> is always rejected, whatever the source.<\/p><\/dd>\n\n<\/dl>\n\n\n0.4.2<\/h4>\n\n
\n
Requires Plugins: woocommerce<\/code> header: the plugin only hooks into the WooCommerce login and registration forms, so WordPress now refuses to activate it without WooCommerce instead of activating and doing nothing.<\/li>\n<\/ul>\n\n0.4.1<\/h4>\n\n
\n
sanitize_text_field()<\/code> when saved: it is an opaque credential and sanitizing could corrupt valid secrets. Same for the OAuth authorization code on the callback.<\/li>\n0.4.0<\/h4>\n\n
\n
pixelhunter-social-login<\/code>; the bundled update checker and the Update URI<\/code> header were removed (updates now come from the directory).<\/li>\n\/wp-json\/pixelhunter-social-login\/v1\/\u2026<\/code>. Re-copy it from WooCommerce \u2192 Social Login<\/strong> into the Google Cloud Console and the Azure portal, otherwise sign-in fails with redirect_uri_mismatch<\/code>.<\/li>\n0.3.3<\/h4>\n\n
\n
<img><\/code> from the screenshots section, so the images are injected after parsing (from the repo assets) instead.<\/li>\n<\/ul>\n\n0.3.2<\/h4>\n\n
\n
readme.txt<\/code> that populates the \"View Details\" modal (Description, Installation, FAQ, Changelog).<\/li>\n0.3.1<\/h4>\n\n
\n
Version:<\/code> header and offered on the normal Plugins \u2192 Updates screen. Update URI: false<\/code> keeps wordpress.org from hijacking the slug.<\/li>\n<\/ul>\n\n0.3.0<\/h4>\n\n
\n
0.2.1<\/h4>\n\n
\n
0.2.0<\/h4>\n\n
\n
wp_login<\/code> on OAuth login; JWT clock-skew leeway; stored admin secret masked in the UI.<\/li>\n<\/ul>\n\n0.1.1<\/h4>\n\n
\n
box-sizing<\/code> fix on the buttons; setup-instruction updates.<\/li>\n<\/ul>\n\n0.1.0<\/h4>\n\n
\n
\/start<\/code> and \/callback<\/code> endpoints, single-use state<\/code>\/nonce<\/code> CSRF protection, full id_token<\/code> claim validation against the provider JWKS, secure account lookup\/create\/link, the Google button via WooCommerce hooks, and the admin settings page with setup guide and live status.<\/li>\n<\/ul>","raw_excerpt":"Google and Microsoft login\/registration for WooCommerce (OAuth 2.0 \/ OpenID Connect) \u2014 self-contained, no third-party services.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/346795","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=346795"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/pixelhunter"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=346795"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=346795"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=346795"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=346795"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=346795"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=346795"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}