Cookies are now tied to internal sessions in WordPress 4.0.
This means plugins using basic cookie authentication will have trouble because a token is required for publishing a post or page (as well as update a plugin or core). I've seen this reported for three different bridge plugins.
The old method (used in numerous plugins) was to use wp_set_auth_cookie($user_id,0,0)
but this will no longer work. The user is logged into the site but the user with the correct roles cannot publish a post or page. Instead an nonce error is returned ("Are you sure you want to do this?)
This is the new code (among many other attempts) I've tried but still get the same nonce error.
wp_set_auth_cookie( $user_id, 0, 0 );
$manager = WP_Session_Tokens::get_instance( $user_id );
$token = $manager->create( $expiration );
To overcome this issue, and temporarily, the wp_verify_nonce is set to always return 1. However, I'd like to know how to create the token upon the set of the cookie.
Has anyone overcome this issue yet? Since this is all new code for WP, does anyone have any suggestions?
UPDATE: After spending a few hours this evening looking at this problem again ... I realized that a Zend_Debug::dump($_COOKIE);
might be helpful. Sure enough the string in two cookies do not match.
The string for these two don't match in the hmac.
'wordpress_logged_in_4ed466320671a355e05b9bf211271dd6'
'wordpress_4ed466320671a355e05b9bf211271dd6'
Interestingly, if I do a Zend_Debug::dump($cookie_elements['hmac']);
the string returned matches the wordpress_4.... value and not the wordpress_logged_in.
The mismatch leads to a nonce error.