Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company.

My company recently spent a bunch of money on a security audit by consultants and they found the following issues regarding login/cookie and how they work in Wordpress.

-User session cookies are not secure -session validation is not destroyed and is still active when a user logs out -session cookie includes the username in it

Is there any way do fix these issues?

share|improve this question

1 Answer 1

The functions that generate, validate and clear auth cookies are all pluggable (meaning you can write your own versions of them). Just note that some of them may need to return something specific (like the user ID).

One note: the cookies should, in fact, be destroyed when you log out. If they're not being destroyed, something is probably wrong. And "User session cookies are not secure" is pretty vague--you should ask for more input before you can conceptualize how to resolve this.

To solve your "session cookie includes username" problem, you could encrypt/obfuscate the value somehow before setting it, and decrypt it before running it through the auth check.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.