I have a front-end login process via admin-ajax.php. It's a standard user/pass form so I submit the POST request to a secure, https, endpoint regardless of whether the user is currently on a secure connection. The user is thus logged in on the secure domain - but WordPress does not recognize the login on the insecure domain she may be browsing from. How can I set cookies on both secure and non-secure origins at the same time? I've been exploring something like hooking into the set_logged_in_cookie action but can't get both sets of cookies to stick.

Related but unanswered questions: How can I make an Ajax login form work with FORCE_SSL_ADMIN enabled? and AJAX-login over https on a http page, is it possible?

  • The first question actually have several answers most of them are good, so why neither of them apply to you? Apr 23, 2016 at 20:12
  • @MarkKaplun because they are answers to a different question. I'm trying to set cookies on both secure and insecure at the same time, not one or the other.
    – editor
    Apr 23, 2016 at 20:14
  • Yes, you do want to do something insecure and wordpress do not make it easier ;) sounds like your design is lacking, either you have authentication cookies on http or you have security, you can not have both Apr 23, 2016 at 20:17
  • @MarkKaplun I'm not following. Thousands and thousands of websites login users over https from http pages. This is in fact much more secure than using http straight up.
    – editor
    Apr 23, 2016 at 20:45
  • 1
    but once you are logged in, you are served only https and therefor do not need the http auth cookie. Apr 23, 2016 at 21:01


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.