When I attempt an OAuth handshake, the first step is a GET call to obtain an access code like so.

# Redirect to request authorization code
$url = $this->get_authorization_url();
header("Location: $url");

Just before I send this I store the current URL in a $_SESSION['last_url'] variable so that after authentication is complete I can redirect it back to the page the user originally attempted.

This authorization url uses the client id and secret to obtain an access code which is then returned to my callback script. The problem is the moment I land on my callback page the $_SESSION is completely blank. I need to ensure I can get this original URL to the end of the handshake and after an entire day devoted to this I'm desperate for some answers.

NOTE: Also should be noted that this site is hosted on WordPress Engine which has a strong caching mechanism which could be a cause of this problem, but even if it is I need a solution around it.

  • Did you use session_start() in your code? Also, have you read wpengine.com/support/cookies-and-php-sessions? As that article suggests, storing your data in the database would be a good alternative to PHP sessions.
    – swissspidy
    Jan 19, 2018 at 10:56
  • how is this wordpress specific? In general sessions should never be used, Jan 19, 2018 at 12:00
  • If I store this in the database as a transient how would I know what to retrieve from the callback perspective? It's going to come back with a code and no details as to who's session this code belongs to. And yes I have start_session() included. Jan 19, 2018 at 18:24
  • a lot of WP hosts don't support PHP session variables, particularly WP Engine. It's also incompatible with most caching mechanisms
    – Tom J Nowell
    Aug 11, 2021 at 23:37


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.