10

Wordpress does not use sessions.

I always wondered what mechanism does WP use to maintain a user state when user goes from page to page?

2 Answers 2

13

It uses bare cookies and stores the login state information client side.

enter image description here

+

enter image description here

=

wordpress_7339a175323c25a8547b5a6d26c49afa=yourusername%7C1457109155%7C170f103ef3dc57cdb1835662d97c1e13;

Where do all these cookies and salt come from?

The salt is in your wp-config.php file:

/**#@+
 * Authentication Unique Keys and Salts.
 *
 * Change these to different unique phrases!
 * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 *
 * @since 2.6.0
 */
define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

The unique phrases are used in a cryptographic hash function

The authentication cookie, the name of which is stored inside of AUTH_COOKIE, which is formed by concatenating “wordpress_” with the md5 sum of the siteurl set in default-constants.php. This is the default behavior and can be overridden from inside your configuration file, by setting up some of the constants upfront.

The authentication cookie a concatenation of the username, a timestamp until which the authentication cookie is valid., and an HMAC, which is sort of a key-biased hash for those who pulled of a TL;DR right now. The three variables are concatenated with the pipe character |.

Here is how the HMAC is constructed:

$hash = hash_hmac('md5', $username . '|' . $expiration, wp_hash($username . substr($user->user_pass, 8, 4) . '|' . $expiration, $scheme));

Is this secure?

According to this article where most of the information in this answer came from it would take a hacker about week to brute force in sending 30 requests a second if they knew what your unique phrase was and 200,000,000,000,000,000,000,000,000,000,000 times harder if your keys are unique.

3
  • Chris. Isn't sessions do exactly the same? Sessions require a cookie on the client site and server uses that to identify which user it is dealing with. I do not see what the difference is between a session based implementation and this. May 3, 2012 at 11:31
  • 2
    I am suddenly hungry.
    – Kevin
    May 3, 2012 at 11:37
  • 2
    PHP Sessions store and track login information inside the $_SESSION super global. A session expires when you close your browser. The WordPress Auth cookie lasts for much longer days or even weeks. See: tuxradar.com/practicalphp/10/1/0
    – Chris_O
    May 3, 2012 at 12:00
0

Cookies are just the client-side storage of session data... WordPress Cookies

In fact, one can have cookies without sessions, but no sessions without cookies.

4
  • I'm afraid you are dead wrong on that. wordpress does not use sessions at all. May 9, 2012 at 19:03
  • PHP cookies are part of PHP sessions - even if WP probably may not utilize server-side sessions for session data storage (in order to be compatible with some crappy shared hostings). May 13, 2012 at 5:39
  • I'm not sure what you mean by that. In order to use sessions in php, you've got to enable sessions at the top of your page by using session_start() explicitly. Now, obviously, wordpress does not have session_start() anywhere in its core. See where I'm getting confused by your last comment? May 15, 2012 at 2:00
  • It's just basic principles of PHP sessions ... that session_start() enables server-side storage whilst setcookie() enable client-side storage of session data. Maybe just get rid of the idea that sessions and cookies are something completely different - the only real difference is the storage location. May 28, 2012 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.