I need to be able to validate the session integrity from an external app. I can't find where is the session stored in wordpress?

I built a restful app that will receive the session token as a header and I would like to be able to load the user associdated to that session. Is that possible? I'm sure it is, I just can't find anywhere. I tried to lookup the code but I get lost quickly.. Anyone can at least point me in which table I should check?

2 Answers 2


How WordPress stores cookies (client-side, as @birgire stated): https://codex.wordpress.org/WordPress_Cookies

I doubt this will ever work from a separate subdomain as the cookie domain is usually fully-qualified to the WordPress siteurl (someone feel free to correct me.)

If you were doing it with another app on the same domain, you'd need to make use of the wp_validate_auth_cookie() function (in wp-includes/pluggable.php) - that looks at $_COOKIES, generates a hash from the user's database record and checks if it matches the cookie. If it does, you get their user ID back.


WordPress sessions are stored according to your PHP settings, by default in your file system. Check out your PHP.ini file for the session.save_path setting. You should note that WordPress doesn't create a session unless the user logs in.

Assuming your "external" app is on the same server and running as PHP, you could simply open the same session using:

  • 5
    WordPress is not storing server-side sessions for logged in users, but uses client-side cookies instead, to my knowledge. Can you elaborate?
    – birgire
    Apr 11, 2015 at 17:20
  • It's on the same server, different subdomain. How would that allow me to load the session? thanks for you reply Apr 11, 2015 at 17:20
  • 2
    @birgire I also learned that. But after Oliver's answer, I's in doubt actually. +1 for your comment. Apr 12, 2015 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.