Slim functions extracted from WordPress to validate logged in Cookie

verify-wordpress-cookie.php

<?php
define('COOKIEHASH', md5('example.com')); // 	get_option('siteurl')
define('LOGGED_IN_COOKIE', 'wordpress_logged_in_' . COOKIEHASH);
define('LOGGED_IN_KEY',    'same_you_set_in_wp_config'); // use you wp-config.php
define('LOGGED_IN_SALT',   'same_you_set_in_wp_config'); // actual values

use App\User; // or your own Corcel\User subclass

function wp_validate_logged_in_cookie() {
    $cookie_elements = wp_parse_logged_in_cookie();
    if ( ! $cookie_elements ) {
        return false;
    }
    $username   = $cookie_elements['username'];
    $hmac       = $cookie_elements['hmac'];
    $token      = $cookie_elements['token'];
    $expired    = $cookie_elements['expiration'];
    $expiration = $cookie_elements['expiration'];

    // Quick check to see if an honest cookie has expired.
    if ( $expired < time() ) {
        return false;
    }

    $user = User::where( 'user_login', $username )->first();
    if ( ! $user ) {
        return false;
    }

    $pass_frag = substr( $user->user_pass, 8, 4 );
    $key = wp_hash( $username . '|' . $pass_frag . '|' . $expiration . '|' . $token );
    // If ext/hash is not present, compat.php's hash_hmac() does not support sha256.
    $algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
    $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );
    if ( ! hash_equals( $hash, $hmac ) ) {
        return false;
    }

    $verified = verifyUserToken( $user, $token );
    if ( ! $verified ) {
        return false;
    }

    return $user->ID;
}

function verifyUserToken(User $user, string $token): bool {
    $verifier = hash_token( $token );

    $sessions = getValidSessions($user);

    return isset( $sessions[ $verifier ] );
}

function getValidSessions(User $user): array {
    $sessionTokens = unserialize($user->getMeta('session_tokens'));
    if ( ! is_array( $sessionTokens ) ) {
        return [];
    }
    $sessions = array_map('prepare_session', $sessionTokens);
    return array_filter($sessions, 'is_still_valid');
}

function hash_token( string $token ) {
    if ( function_exists( 'hash' ) ) {
        return hash( 'sha256', $token );
    } else {
        return sha1( $token );
    }
}

function prepare_session( $session ) {
    if ( is_int( $session ) ) {
        return array( 'expiration' => $session );
    }

    return $session;
}

function is_still_valid( $session ) {
    return $session['expiration'] >= time();
}

function wp_parse_logged_in_cookie() {
    if ( empty( $_COOKIE[ LOGGED_IN_COOKIE ] ) ) {
        return false;
    }
    $cookie = $_COOKIE[ LOGGED_IN_COOKIE ];

    $cookie_elements = explode( '|', $cookie );
    if ( count( $cookie_elements ) !== 4 ) {
        return false;
    }

    list( $username, $expiration, $token, $hmac ) = $cookie_elements;

    return compact( 'username', 'expiration', 'token', 'hmac' );
}

function wp_hash( $data ) {
    $salt = LOGGED_IN_KEY . LOGGED_IN_SALT;

    return hash_hmac( 'md5', $data, $salt );
}