7

I am trying to understand how WordPress determines where a user is logged in or not? I read that it's done using just the cookies; but with WordPress 4, there's a new addition: wp_session_tokens. I tried to read the codex and searching on the Internet, but there's not much useful information.

Questions:

  1. What's the typical use of wp_session_tokens?

  2. Can I use them to login/logout a user? Or should I simply rely on set_current_user and set_auth_cookie functions to manage user login?

  3. Are there any disadvantages of wp_session_tokens?

Would really appreciate if you could space some time to explain what these session tokens do.

Improve this question

1 Answer 1

Reset to default
4

Normal cookies, as used by WordPress to keep you logged in for a certain period, are the way to check whether a user is logged in. Even if you close your computer they will be there when you switch it on again.

Session tokens are something different. They are meant to transfer information between several page requests. The typical example is the content of a shopping cart that should be displayed while you browse through the pages of an online shop. You could pass that information using query arguments (like www.example.com\?cart="book:Moby_Dick_1799847h4"), but that would involve sending a lot of information every time. In stead, the token is passed and the server knows what cart content to display.

Unless the session token is stored as a cookie on your pc and the server stores the cart content related to that cookie, the sessions disappears as soon as you close your browser. So, session tokens are less permanent than cookies.

You could use session tokens to check if people are still logged in. That would force people to log in every time they open the site. In that case you would also have to disable the normal login procedure.

There might be circumstances where using session tokens to identify users could go wrong. For instance, if you have a large site, distributed over several servers, you may have a valid session with one server, but the load balancer might decide to send you to another, making you lose your session and hence forcing you to login again. The cookies approach would not suffer from this, as all servers will consult the same database to determine whether you are logged in legitimately.

Summing up: unless you're really skilled with security procedures, stick with the one WordPress provides you with.

Improve this answer
3
  • Thanks a lot. Curious to know whether the session tokens have any added advantage over WordPress Transients. From what I know, I think transients too can be used to maintain data for a limited time. That said, is wp_set_current_user( $user_id, $user->user_login ); wp_set_auth_cookie( $user_id ); do_action( 'wp_login', $user->user_login ); the only and right way to log user in?
    – TheBigK
    Mar 26, 2017 at 4:52
  • Transients are a form of caching and should not be used for user authentication. Perhaps you should ask a different question explaining what you don't like about WP's login procedure and asking if it is possible to do something about that.
    – cjbj
    Mar 27, 2017 at 8:14
  • My apologies. There's nothing that I do not like about WP Login. I'm only trying to figure out the 'right' way to login. Could you please confirm if the above two lines wp_set_current_user() and wp_set_auth_cookie are the lines required to login a user securely?
    – TheBigK
    Mar 27, 2017 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.