Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Wordpress does not use sessions.

I always wondered what mechanism does WP use to maintain a user state when user goes from page to page?

share|improve this question

2 Answers 2

Cookies are just the client-side storage of session data... WordPress Cookies

In fact, one can have cookies without sessions, but no sessions without cookies.

share|improve this answer
    
I'm afraid you are dead wrong on that. wordpress does not use sessions at all. –  Average Joe May 9 '12 at 19:03
    
PHP cookies are part of PHP sessions - even if WP probably may not utilize server-side sessions for session data storage (in order to be compatible with some crappy shared hostings). –  syslogic May 13 '12 at 5:39
    
I'm not sure what you mean by that. In order to use sessions in php, you've got to enable sessions at the top of your page by using session_start() explicitly. Now, obviously, wordpress does not have session_start() anywhere in its core. See where I'm getting confused by your last comment? –  Average Joe May 15 '12 at 2:00
    
It's just basic principles of PHP sessions ... that session_start() enables server-side storage whilst setcookie() enable client-side storage of session data. Maybe just get rid of the idea that sessions and cookies are something completely different - the only real difference is the storage location. –  syslogic May 28 '12 at 16:01

It uses bare cookies and stores the login state information client side.

enter image description here

+

enter image description here

=

wordpress_7339a175323c25a8547b5a6d26c49afa=yourusername%7C1457109155%7C170f103ef3dc57cdb1835662d97c1e13;

Where do all these cookies and salt come from?

The salt is in your wp-config.php file:

/**#@+
 * Authentication Unique Keys and Salts.
 *
 * Change these to different unique phrases!
 * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 *
 * @since 2.6.0
 */
define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

The unique phrases are used in a cryptographic hash function

The authentication cookie, the name of which is stored inside of AUTH_COOKIE, which is formed by concatenating “wordpress_” with the md5 sum of the siteurl set in default-constants.php. This is the default behavior and can be overridden from inside your configuration file, by setting up some of the constants upfront.

The authentication cookie a concatenation of the username, a timestamp until which the authentication cookie is valid., and an HMAC, which is sort of a key-biased hash for those who pulled of a TL;DR right now. The three variables are concatenated with the pipe character |.

Here is how the HMAC is constructed:

$hash = hash_hmac('md5', $username . '|' . $expiration, wp_hash($username . substr($user->user_pass, 8, 4) . '|' . $expiration, $scheme));

Is this secure?

According to this article where most of the information in this answer came from it would take a hacker about week to brute force in sending 30 requests a second if they knew what your unique phrase was and 200,000,000,000,000,000,000,000,000,000,000 times harder if your keys are unique.

share|improve this answer
    
Chris. Isn't sessions do exactly the same? Sessions require a cookie on the client site and server uses that to identify which user it is dealing with. I do not see what the difference is between a session based implementation and this. –  Average Joe May 3 '12 at 11:31
2  
I am suddenly hungry. –  Kevin May 3 '12 at 11:37
2  
PHP Sessions store and track login information inside the $_SESSION super global. A session expires when you close your browser. The WordPress Auth cookie lasts for much longer days or even weeks. See: tuxradar.com/practicalphp/10/1/0 –  Chris_O May 3 '12 at 12:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.