0

I have a wordpress installation on my virtual host, where the document root is accessible as both "somesite.com" as well as "www.somesite.com". If I set up site_url as "http://somesite.com", then when I access "www.somesite.com" then wordpress thinks I am not logged in (and I can't see private posts and such), while if I set site_url to "http://www.somesite.com", then the same problem happens with "somesite.com".

I would really like both variations to be acceptable.

6
  • Typically one of the two domains is chosen as the real domain with the other silently redirecting from the server. Also, all the links on the public side will be to the domain in site_url. Commented Dec 9, 2013 at 1:53
  • The setup you suggest is a bit more complicated then what I can afford now, considering that this problem only affects registered users you aren't paying attention (probably about 2 of my users). I'd still like to get down to the reason for this and solve it properly and not heavy handedly.
    – Guss
    Commented Dec 9, 2013 at 12:09
  • If you are on Apache, then it takes 2 minutes to add it to your .httaccess file. Commented Dec 9, 2013 at 15:13
  • Actually, I just remembered you don't have to do that as WordPress enforces this by itself. It is known as the canonical URLs. WordPress by default will redirect to the domain name set in the settings if the current domain is another. Commented Dec 9, 2013 at 15:35
  • 1
    My set up is a little different then a straight up Wordpress install, and so Wordpress doesn't do that redirect (nor do I want it to). If there is no other option, I'll see if I can write this myself.
    – Guss
    Commented Dec 9, 2013 at 21:17

1 Answer 1

3

While www and non-www versions of site are considered kind of same thing from user perspective, technically they are two completely different domains, possibly hosting completely different sites on different servers.

Since cookies are domain-specific WP treats them accordingly.

It's not impossible to rework this, since cookie-related functions seem to mostly be pluggable, but really the most common and practical solution is to have canonical version and have other redirect to it.

5
  • its interesting that you say that, because according to Firefox's developer console, Firefox sends the PHP session cookie as well as the wordpress cookies for both the www and non-www versions, so it can't be only cookie based.
    – Guss
    Commented Dec 8, 2013 at 22:44
  • Do you have any images or other media coming from the other domain? If so, the cookie will be sent to those. But the cookie by spec will not be sent to a domain it is not for. So, not sure what you are seeing, but Firefox should not be sending the cookie per the security spec. Commented Dec 9, 2013 at 1:48
  • See RFC6265#4.1.2.3: For example, if the value of the Domain attribute is "example.com", the user agent will include the cookie in the Cookie header when making HTTP requests to example.com, www.example.com, and www.corp.example.com . So Firefox appears to behave according to the specification.
    – Guss
    Commented Dec 9, 2013 at 12:07
  • Yes, but cookies being available doesn't mean WP does (or should) check them for all sub domains. As above - they might be completely different installs.
    – Rarst
    Commented Dec 9, 2013 at 16:22
  • I'm not sure why you say that - Wordpress is being called and should read the cookies it was sent. If the cookie is from a different install, then it won't much the stored session IDs, right? Regardless - the cookies in my setup are completely valid, but Wordpress ignores them anyway. I want to understand why, and how to fix it.
    – Guss
    Commented Dec 9, 2013 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.