I've been trying to make a custom login page with my own forms and such (wp_login_form is not appropriate for my purpose here), but while it does successfully seems to log in, it does not stay that way upon redirection or refresh.

I've tried a few variations, this one being the current one :

$creds = array();
$creds['user_login'] = $login;
$creds['user_password'] = $password;
$creds['remember'] = true;
$user = wp_signon($creds, false);
if ( is_wp_error($user) )
    echo $user->get_error_message();
    wp_set_current_user($user->ID, $login);
    wp_set_auth_cookie($user->ID, true);
    do_action("wp_login", $login);

(there will eventually be more for the custom login but I'd like to get it to work for now)

The user is indeed marked as logged in after this, but if I try to refresh the page, either manually or via wp_redirect($_SERVER['HTTP_REFERER']), the user is not marked as logged in anymore.

This function is currently directly in the PHP of the custom page, should it be written another way, perhaps?

  • Is the cookie actually being sent (use you browser's dev tools)? Does your browser send it to the next page? Are you certain that the request where you're not logged in isn't coming from a (server or client side) cache? – janh Jan 11 '18 at 8:28
  • I don't see any cookie being sent in the Network tab. The application tab lists a few cookies in the page, but no more than on any other page of the site while logged out (90planBAK, 90planD, CONSENT, NID and wordpress_test_cookie) – Slereah Jan 11 '18 at 8:45
  • You might have some whitespace somewhere that ends header phase so the cookie cannot get sent. Enable WP_DEBUG and also check your error logs to see if any warnings about "headers already sent" pop up. – janh Jan 11 '18 at 9:03
  • I do indeed get the following warnings : Warning: Cannot modify header information - headers already sent by (output started at /home/xxx/wp-includes/formatting.php:5087) in /home/xxx/wp-includes/pluggable.php on line 914 – Slereah Jan 11 '18 at 9:06
  • If I put the function as an add_action( 'init', 'process_post' ), the warnings disappear but the user still doesn't log in. – Slereah Jan 11 '18 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.