XF 2.3 Connecting to XenForo's new login system (2.3.*)?

[DarkUnderlord]

We've got a forum we haven't upgraded to 2.3.* yet because of the changes to the XenForo login system.

Question: How do I use the new login system, or how can I get some basic info out of it?

We currently use this gaggle of code that sets up the XF $visitor object which lets us know if a user is logged in, who they are etc..:

// XenForo 2 Authentication
$startTime = microtime(true);
$fileDir = $webRoot . '/forums';

require($fileDir . '/src/XF.php');
XF::start($fileDir);
$app = XF::setupApp('XF\Pub\App');
$app->start();
// To handle bbcode parsing errors
XF::app()->templater()->addDefaultParam( 'xf', [
    'visitor' => \XF::visitor(),
    'ignoreUserRepo' => $app->repository('AddonFlare\GlobalIgnore:User'),
] );

// Connect to the DB

// Setup the XenForo visitor object.
$visitor = \XF::visitor();

I basically pull out some basic info (user_id, username) and dump the rest. This code handles our website front-end. So if you're logged into the forums, you're logged into the rest of the website.

How do I do that now with 2.3.*?

 

[qubn]

Your existing code already works on 2.3, you can just upgrade. The session/visitor system is unchanged.

The "new login system" in 2.3 refers to passkey/WebAuthn support (passwordless login) and a built-in OAuth 2.0 server (for "Login with XenForo" flows on external sites). These are additional ways for users to authenticate through XenForo's login form, but once authenticated, whether by password, passkey, or remember cookie, they all end up in the same xf_session table.

Your bootstrap code:

require($fileDir . '/src/XF.php');
XF::start($fileDir);
$app = XF::setupApp('XF\Pub\App');
$app->start();
$visitor = \XF::visitor();

This is exactly the right approach and works identically on 2.3. $app->start() reads the session cookie, checks the remember-me cookie if needed, validates the password date, and sets \XF::visitor(), same as it always has. Your external site will keep getting user_id, username, and everything else off $visitor just like before.