achieving login implementation without using sessions

Question

Wordpress does not use sessions.

I always wondered what mechanism does WP use to maintain a user state when user goes from page to page?

Answer 1

It uses bare cookies and stores the login state information client side.

+

=

wordpress_7339a175323c25a8547b5a6d26c49afa=yourusername%7C1457109155%7C170f103ef3dc57cdb1835662d97c1e13;

Where do all these cookies and salt come from?

The salt is in your wp-config.php file:

/**#@+
 * Authentication Unique Keys and Salts.
 *
 * Change these to different unique phrases!
 * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 *
 * @since 2.6.0
 */
define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

The unique phrases are used in a cryptographic hash function

The authentication cookie, the name of which is stored inside of AUTH_COOKIE, which is formed by concatenating “wordpress_” with the md5 sum of the siteurl set in default-constants.php. This is the default behavior and can be overridden from inside your configuration file, by setting up some of the constants upfront.

The authentication cookie a concatenation of the username, a timestamp until which the authentication cookie is valid., and an HMAC, which is sort of a key-biased hash for those who pulled of a TL;DR right now. The three variables are concatenated with the pipe character |.

Here is how the HMAC is constructed:

$hash = hash_hmac('md5', $username . '|' . $expiration, wp_hash($username . substr($user->user_pass, 8, 4) . '|' . $expiration, $scheme));

Is this secure?

According to this article where most of the information in this answer came from it would take a hacker about week to brute force in sending 30 requests a second if they knew what your unique phrase was and 200,000,000,000,000,000,000,000,000,000,000 times harder if your keys are unique.

Answer 2

Cookies are just the client-side storage of session data... WordPress Cookies

In fact, one can have cookies without sessions, but no sessions without cookies.