When I attempt an OAuth handshake, the first step is a GET call to obtain an access code like so.

# Redirect to request authorization code
$url = $this->get_authorization_url();
header("Location: $url");

Just before I send this I store the current URL in a $_SESSION['last_url'] variable so that after authentication is complete I can redirect it back to the page the user originally attempted.

This authorization url uses the client id and secret to obtain an access code which is then returned to my callback script. The problem is the moment I land on my callback page the $_SESSION is completely blank. I need to ensure I can get this original URL to the end of the handshake and after an entire day devoted to this I'm desperate for some answers.

NOTE: Also should be noted that this site is hosted on WordPress Engine which has a strong caching mechanism which could be a cause of this problem, but even if it is I need a solution around it.

  • Did you use session_start() in your code? Also, have you read wpengine.com/support/cookies-and-php-sessions? As that article suggests, storing your data in the database would be a good alternative to PHP sessions.
    – swissspidy
    Commented Jan 19, 2018 at 10:56
  • how is this wordpress specific? In general sessions should never be used, Commented Jan 19, 2018 at 12:00
  • If I store this in the database as a transient how would I know what to retrieve from the callback perspective? It's going to come back with a code and no details as to who's session this code belongs to. And yes I have start_session() included. Commented Jan 19, 2018 at 18:24
  • a lot of WP hosts don't support PHP session variables, particularly WP Engine. It's also incompatible with most caching mechanisms
    – Tom J Nowell
    Commented Aug 11, 2021 at 23:37


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.