Cookies are now tied to internal sessions in WordPress 4.0.

This means plugins using basic cookie authentication will have trouble because a token is required for publishing a post or page (as well as update a plugin or core). I've seen this reported for three different bridge plugins.

The old method (used in numerous plugins) was to use wp_set_auth_cookie($user_id,0,0) but this will no longer work. The user is logged into the site but the user with the correct roles cannot publish a post or page. Instead an nonce error is returned ("Are you sure you want to do this?)

This is the new code (among many other attempts) I've tried but still get the same nonce error.

wp_set_auth_cookie( $user_id, 0, 0 );
$manager = WP_Session_Tokens::get_instance( $user_id );
$token = $manager->create( $expiration );

To overcome this issue, and temporarily, the wp_verify_nonce is set to always return 1. However, I'd like to know how to create the token upon the set of the cookie.

Has anyone overcome this issue yet? Since this is all new code for WP, does anyone have any suggestions?

UPDATE: After spending a few hours this evening looking at this problem again ... I realized that a Zend_Debug::dump($_COOKIE); might be helpful. Sure enough the string in two cookies do not match.

The string for these two don't match in the hmac.



Interestingly, if I do a Zend_Debug::dump($cookie_elements['hmac']); the string returned matches the wordpress_4.... value and not the wordpress_logged_in.

The mismatch leads to a nonce error.

  • What specifically is the nonce error you're getting? Did you try reporting a wordpress bug or topic on wp-hackers, with minimal example plugin causing the bug?
    – NoBugs
    Commented Sep 9, 2014 at 2:18
  • The nonce is the general "Are you sure you want to do this?" as stated in OP. After emailing a few different core developers, this problem has been submitted to trac. Again, this issue is found in three different bridges.
    – LPH
    Commented Sep 9, 2014 at 5:43
  • Same issue here. Link to @LPH submitted trac ticket #29594 : Basic Cookie Authentication from External Database
    – here
    Commented Nov 3, 2014 at 19:29

3 Answers 3


Actually, just doing this check fixed this issue.

        wp_set_auth_cookie($userid, true, false);  

seems to have fixed this issue.

@here,your proposed solution didn't work for me and just redirected me to login page when trying to get into dashboard

  • This fixed my code, too. Thank you for the conditional.
    – LPH
    Commented Jan 20, 2015 at 0:08

Revised: After adding an early test to avoid trying to re-login an already-logged-in user, I was able to remove all session and cookie handling entirely and rely on a single call to wp_set_current_user

Good luck!

This solves the problem for me so far and uses the new WP_Session_Tokens class to update the current user's session and token.

Prior code left inline, but commented out.

Thanks for the pointers @LPH, much appreciated.

$username = 'username';

// Edge case handles when plugin is activated and still logged in as old user.
// wp_clear_auth_cookie();

// Setup new user.
$user = wp_set_current_user($user_id, $username);

// wp_set_auth_cookie($user_id, 1);

// Required for WP 4.0
// https://core.trac.wordpress.org/ticket/20276
// $sessionManager = WP_Session_Tokens::get_instance( $user_id );
// $token = $sessionManager->create(time() + (1 * 24 * 60 * 60));
// $session = $sessionManager->get($token);
// $sessionManager->update($token,$session);

The authentication was done by creating a wp_validate_auth_cookie function and calling it.

if ( ! function_exists( 'wp_validate_auth_cookie' ) ) :

function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) {

    if ( XenWord::getVisitor()->getUserId() != 0 ) {
        return XenWord::getVisitor()->getUserId();

    return false;


Then call this replacement in the login portion of your code.

    $current_user = get_userdata( $user_id );

    wp_set_current_user( $user_id );

    wp_validate_auth_cookie($cookie = '', $scheme = '');

    // Check to determine if adding XF users to WP database

    return $current_user;

Caching plugins now work again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.