wp_generate_auth_cookie( int $user_id, int $expiration, string $scheme = 'auth', string $token = '' ): string

951	function wp_generate_auth_cookie( $user_id, $expiration, $scheme = 'auth', $token = '' ) {952		$user = get_userdata( $user_id );953		if ( ! $user ) {954			return '';955		}956 957		if ( ! $token ) {958			$manager = WP_Session_Tokens::get_instance( $user_id );959			$token   = $manager->create( $expiration );960		}961 962		if ( str_starts_with( $user->user_pass, '$P$' ) || str_starts_with( $user->user_pass, '$2y$' ) ) {963			// Retain previous behaviour of phpass or vanilla bcrypt hashed passwords.964			$pass_frag = substr( $user->user_pass, 8, 4 );965		} else {966			// Otherwise, use a substring from the end of the hash to avoid dealing with potentially long hash prefixes.967			$pass_frag = substr( $user->user_pass, -4 );968		}969 970		$key = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme );971 972		$hash = hash_hmac( 'sha256', $user->user_login . '|' . $expiration . '|' . $token, $key );973 974		$cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;975 976		/**977		 * Filters the authentication cookie.978		 *979		 * @since 2.5.0980		 * @since 4.0.0 The `$token` parameter was added.981		 *982		 * @param string $cookie     Authentication cookie.983		 * @param int    $user_id    User ID.984		 * @param int    $expiration The time the cookie expires as a UNIX timestamp.985		 * @param string $scheme     Cookie scheme used. Accepts 'auth', 'secure_auth', or 'logged_in'.986		 * @param string $token      User's session token used.987		 */988		return apply_filters( 'auth_cookie', $cookie, $user_id, $expiration, $scheme, $token );989	}