0

I'm moving my WordPress multisite from one server to another, and have decided to use a WAMP (Uniserver Zero) for the new setup.

I'm having one issue that doesn't occur on the old setup, only the new one:

In the header of my theme I have a Login link, or 'Welcome, [name with link to profile] [logout link]' if the user has already logged in.

When logging into Wordpress, I'm taken to the homepage and I notice it still says 'login' in the header, rather than my name and profile/logout links. If I change the url of any page to https instead of http, the name and profile/logout links appear. So for some reason Wordpress doesn't think I'm logged in when viewing in http, only when https.

I'm not sure if this is something in my Wordpress setup or apache or php.

Here are a few details from phpinfo that might help:

  • Server Root C:/UniServerZ/core/apache2
  • DOCUMENT_ROOT C:/UniServerZ/www/wordpress
  • US_ROOTF_SSL C:/UniServerZ/www
  • US_ROOTF_WWW C:/UniServerZ/www

EDIT It looks like this is an issue since Wordpress 4.0. The old setup was 3.8 https://wordpress.org/support/topic/http-and-https-differences-for-function-is_user_logged_in-in-wordpress-40

Improve this question

1 Answer 1

Reset to default
0

Users which have logged-in via https should always be served content via https otherwise there is no point in having the login form use https at all. With http anyone can intercept the cookie and use it to get to the users's account without even knowing the user and password.

The question here is probably why a logged in user is presented with an http link at all. A way around it might be to detect when the LOGGED_IN_COOKIE cookie is set, and it should be available on http as well as https, and if it is set redirect to https.

Clarification: you don't have to serve everything over https for logged in user, it is just a simpler path to follow IMO. The harder approach is to require login only on pages in which you actually display confidential information to the user but then if your user have the admin bar turned off you can serve the page as http but if it is on you need to go https.

If all you do is to display the user display name and it is a public information then you can derive the user info from the login name which is contained in the LOGGED_IN_COOKIE cookie, but for actual authentication you need to go https.

Improve this answer
4
  • Thanks for the reply Mark. Looking at other websites, on the account-based content is https, everything else is http. Just try on Amazon. After logging in, go to the homepage or a product page, it's http, not https. This is the way I want my site to work.
    – Chris
    Oct 6, 2014 at 8:03
  • The issue may be the server content structure or document root settings. The root cookie plugin fixes the issue for me wordpress.org/plugins/root-cookie.
    – Chris
    Oct 6, 2014 at 8:05
  • @Chris, I added clarification to the answer
    – Mark Kaplun
    Oct 6, 2014 at 8:55
  • Thanks @Mark, I'm understanding now. You're correct, all I need for the header is the logged in name. Thanks for pointing me to LOGGED_IN_COOKIE
    – Chris
    Oct 6, 2014 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.