0

I am using wordpress for a blog on my site. So I installed wordpress in a subdirectory (eg: www.example.com/blog).

I handle all of the sign in/sign out through my main site.

For signing in I set a cookie which is read upon entering the wordpress site.

However, when it comes time to sign out, I want to also remove the cookie that WordPress sets (it starts with "wordpress_logged_in"), so that the user will also be signed out of the wordpress blog.

For some reason, when I get all the cookies sent with the request (javax.servlet.http.HttpServletRequest), the "wordpress_logged_in" cookie (as well as all other cookies set by wordpress) are not recognized.

Other cookies set by plugins on wordpress are recognized, just the cookies set by wordpress directly aren't recognized.

How can I also remove the wordpress cookie (I wanted to loop through all cookies and remove the one starting with "wordpress_logged_in...").

(I'm running in a local environment on 2 different ports, but I don't think that's the issue since the request is returning other cookies set by plugins).

Or, is there a better way to do what I'm trying to do?

Thanks.

  • 1
    the cookie is only available in the subdirectory. to log out the user you can delete the session in the wordpress database – mmm Oct 5 '16 at 16:46
  • Hey, can you give some more information on how this would be done? Thanks. – theyuv Oct 6 '16 at 15:52
2

Your non-wordpress application cannot see the WP cookie because the WP session cookie is only set for the path that WP is installed in (/blog in your example).

You can configure WP to create the session cookie for the root path '/' so your non-wordpress application can manage it by modifying your wp-config.php, add -

define( 'COOKIEPATH','/');
define( 'SITECOOKIEPATH','/');

https://codex.wordpress.org/Editing_wp-config.php

  • wordpress_logged_in... cookie path still set to subdirectory rather than root directory. Also, the documentation you referenced says: "...additional constants that can be defined, but probably shouldn't be" with regards to "COOKIEPATH". Do you have an opinion on whether it is better to change that cookie path as you suggest or remove the "session_tokens" entry from the database as @mmm suggested in the comment above? Thank you. – theyuv Oct 6 '16 at 16:21
  • I adjusted my answer. In your case, I think you will need both COOKIEPATH and SITECOOKIEPATH to be set. That should be it. – user42826 Oct 6 '16 at 21:49
  • Thanks, I haven't tested your updated code yet. I went with the option of removing the session_tokens meta_key in the wp_usermeta table (mainly because wp documentation recommended not messing with the cookie paths). If you have any input on why your solution is better/worse feel free to share. – theyuv Oct 7 '16 at 15:10
  • You should never allow an application access to another applications database. If your application gets hacked, the hackers can delete all your WP content. You are increasing the security risks...its ok just as long as you are aware of it. – user42826 Oct 7 '16 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.