ZapQR Login
| 开发者 | dasecure |
|---|---|
| 更新时间 | 2026年8月31日 22:18 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
- Passkey-first: phishing-resistant WebAuthn sign-in, no passwords anywhere
- Standards-based: OAuth 2.0 authorization-code flow with PKCE; ID tokens verified in the plugin (RS256, JWKS)
- Links existing WordPress users by their verified email — admins keep their role
- New visitors are created with a low-privilege role you choose (Subscriber by default)
- Single logout: logging out of WordPress also ends the ZapQR session
- No external code: the whole flow is server-side redirects and server-to-server calls
安装:
- Install and activate the plugin.
- For SSO: go to Settings > ZapQR Login, copy the Redirect URI and Post-logout URI shown there, register your site at the ZapQR identity provider to get a Client ID and Secret, paste them in, tick Enable, save.
- For QR fill: nothing to configure — the widget appears on wp-login.php. Customize theme and accent color in Settings > ZapQR Login.
屏幕截图:
常见问题:
What does the site receive about the visitor in SSO mode?
Only a verified email address and a stable account identifier, delivered in a cryptographically signed token that the plugin verifies against the provider's published keys. No passwords, no passkeys, no profile data.
Can someone take over an existing account?
No. Linking to an existing WordPress user happens only when the ZapQR identity provider asserts the email is verified; unverified emails are rejected outright. You can also disable linking entirely, and new users always get the low-privilege role you configure.
Where do passkeys live?
With the visitor and the ZapQR identity provider — never on your WordPress site. Your site only consumes the signed sign-in assertion.
Does the QR credential mode still work?
Yes, unchanged. It is a separate, coexisting mode: the ZapQR app stores per-site WordPress credentials locally on the phone (Face ID / Touch ID protected) and relays them to the browser at login.
Does this work with multisite?
Yes.
更新日志:
- Fixed: the QR widget showed a stale, unscannable code after a login was delivered (e.g. after logging out and back in). It now refreshes its session automatically after every successful fill.
- New:
window.ZapQR.refresh()lets themes/plugins request a fresh QR programmatically.
- New: "Sign in with ZapQR" single sign-on (OpenID Connect, authorization-code + PKCE, RS256 ID-token verification via JWKS)
- New: link existing users by verified email; configurable default role for new users; optional single logout through the identity provider
- Changed: the QR widget script is now bundled with the plugin instead of loaded from zapqr.ai
- Hardened: explicit sanitization on all settings
- Initial release: QR code credential fill on wp-login.php, theme and accent customization