I have a front-end login process via admin-ajax.php. It's a standard user/pass form so I submit the POST request to a secure, https, endpoint regardless of whether the user is currently on a secure connection. The user is thus logged in on the secure domain - but WordPress does not recognize the login on the insecure domain she may be browsing from. How can I set cookies on both secure and non-secure origins at the same time? I've been exploring something like hooking into the set_logged_in_cookie action but can't get both sets of cookies to stick.

Related but unanswered questions: How can I make an Ajax login form work with FORCE_SSL_ADMIN enabled? and AJAX-login over https on a http page, is it possible?

  • The first question actually have several answers most of them are good, so why neither of them apply to you? – Mark Kaplun Apr 23 '16 at 20:12
  • @MarkKaplun because they are answers to a different question. I'm trying to set cookies on both secure and insecure at the same time, not one or the other. – editor Apr 23 '16 at 20:14
  • Yes, you do want to do something insecure and wordpress do not make it easier ;) sounds like your design is lacking, either you have authentication cookies on http or you have security, you can not have both – Mark Kaplun Apr 23 '16 at 20:17
  • @MarkKaplun I'm not following. Thousands and thousands of websites login users over https from http pages. This is in fact much more secure than using http straight up. – editor Apr 23 '16 at 20:45
  • 1
    but once you are logged in, you are served only https and therefor do not need the http auth cookie. – Mark Kaplun Apr 23 '16 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.