wp-includes/user.php:326Authenticates the user using the WordPress auth cookie.
$userWP_User|WP_Error|null$usernamestring$passwordstringWP_User|WP_Errorfunction wp_authenticate_cookie( $user, $username, #[\SensitiveParameter] $password) { global $auth_secure_cookie; if ( $user instanceof WP_User ) { return $user; } if ( empty( $username ) && empty( $password ) ) { $user_id = wp_validate_auth_cookie(); if ( $user_id ) { return new WP_User( $user_id ); } if ( $auth_secure_cookie ) { $auth_cookie = SECURE_AUTH_COOKIE; } else { $auth_cookie = AUTH_COOKIE; } if ( ! empty( $_COOKIE[ $auth_cookie ] ) ) { return new WP_Error( 'expired_session', __( 'Please log in again.' ) ); } // If the cookie is not set, be silent. } return $user;}Introduced in 2.8.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.