I need to be able to validate the session integrity from an external app. I can't find where is the session stored in wordpress?

I built a restful app that will receive the session token as a header and I would like to be able to load the user associdated to that session. Is that possible? I'm sure it is, I just can't find anywhere. I tried to lookup the code but I get lost quickly.. Anyone can at least point me in which table I should check?


How WordPress stores cookies (client-side, as @birgire stated): https://codex.wordpress.org/WordPress_Cookies

I doubt this will ever work from a separate subdomain as the cookie domain is usually fully-qualified to the WordPress siteurl (someone feel free to correct me.)

If you were doing it with another app on the same domain, you'd need to make use of the wp_validate_auth_cookie() function (in wp-includes/pluggable.php) - that looks at $_COOKIES, generates a hash from the user's database record and checks if it matches the cookie. If it does, you get their user ID back.

| improve this answer | |

WordPress sessions are stored according to your PHP settings, by default in your file system. Check out your PHP.ini file for the session.save_path setting. You should note that WordPress doesn't create a session unless the user logs in.

Assuming your "external" app is on the same server and running as PHP, you could simply open the same session using:

| improve this answer | |
  • 5
    WordPress is not storing server-side sessions for logged in users, but uses client-side cookies instead, to my knowledge. Can you elaborate? – birgire Apr 11 '15 at 17:20
  • It's on the same server, different subdomain. How would that allow me to load the session? thanks for you reply – Dude from ticketing world Apr 11 '15 at 17:20
  • 2
    @birgire I also learned that. But after Oliver's answer, I's in doubt actually. +1 for your comment. – Mayeenul Islam Apr 12 '15 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.