FluentAuth 2.1: Google One-Tap, and a hardening pass

FluentAuth 2.1.2 is on WordPress.org. It closes out the 2.1 line, which started with Google One-Tap in December and finishes with a hardening pass across the plugin’s own endpoints.

Google One-Tap (2.1.1)

One-Tap makes the Google button a personalised one. A visitor already signed in to Google sees their own name and picture on it, and one click signs them in. It uses the same OAuth client as Login with Google, so if that is set up, One-Tap is one switch under Settings → Social Login.

It shows on wp-login.php and on pages with a FluentAuth form, and anywhere else with the shortcode:

[fluent_auth_google_one_tap delay="2"]

In 2.1.2 the token Google returns is verified server-side against your client ID before a session is issued. Docs.

Hardening (2.1.2)

A security review of the plugin’s own REST endpoints led to stricter validation and sanitisation on the security-scan and settings routes, a sanitised redirect cookie on social login, and single-use, constant-time-compared tokens for remote auth. None of these were reported as exploited; they are the kind of thing a review finds and a release fixes.

Fixes

• The magic-login rate limiter counted its window in days instead of minutes. It now counts minutes, as the setting says.
• GitHub login failed on some sites after the 2.0 changes; fixed.
• Dashboard quick stats and audit-log “x hours ago” values ignored the site timezone; both now use it.
• The fluent_auth/can_user_login filter ignored a falsy return, so a developer could not refuse a login through it. It now respects any falsy value and shows the message from a WP_Error.
• A positional-argument typo in the digest email, and a duplicated filter, fixed.

Translations

Every hard-coded string in the admin app now goes through the translation helper, and a pass over the dashboard, settings, security scan, remote auth and email screens fixed typos and awkward phrasing along the way. If FluentAuth is not yet in your language, the strings are ready on translate.wordpress.org.

Next

The next release was a larger one. FluentAuth 3.0 brought passkeys, authenticator-app two-factor with recovery codes, IP access rules, a single findings screen for the site’s security state, a recovery workflow for after a break-in and a fully redesigned admin panel.

Update from Dashboard → Updates, or with wp plugin update fluent-security.