I have a Wordpress site, and I have another server.

People login into the wordpress site, then at a later stage browse the other server. On the other server page, there are JS fetch requests getting information from the Wordpress REST API. I wish for the Wordpress server to return different results depending on which Wordpress user they are.

I can hook into wp_login, e.g.

function login_server_aswell( $user_login, $user ) {
    // tell server user loggin in, get session token back
    // Now can't store the session token in a place where when they browse to the server webpage it can see the cookie
add_action('wp_login', 'login_server_aswell', 10, 2);

The problem I have, is after I login, I could tell the other server, this user logged in, give me a sessions token. But then I could only store that session token in a cookie under the wordpress site, not under the servers site, because cookies are not cross site.

Any concepts or overall guidance that can point me in the right direction?

  • Can you identify users on the other server? If so, pass the user info as an argument to your REST query and then your WP site can use it in the PHP $request->get_param( 'user_info' )
    – jdm2112
    Jul 9, 2021 at 18:57

1 Answer 1


You could hook into the login process in the WP site and create a unique token (stored in meta) for that user on login. The token can then be sent to the other server, that could query the WP API with that token.

You would have to create a custom endpoint that validates the user token. Probably best to have some hash for the userid also.

Furthermore, on logout from the WP site or in some token validation cronjob, this token has to be invalidated for security purpose. Even better, if it's just one request from the 'other' server, invalidate immediately and if on the WP server again, create a new token. So in effect, it's a CSRF token (nonce) over multiple servers.

  • This is a good idea. One question: "The token can then be sent to the other server"... How does the other server know it can trust the token being sent to it? ...like that is the wordpress server and not some BadHackerGuy. Jul 10, 2021 at 8:47
  • 1
    If you send the token and a hash of the token, the other server can recreate the hash and check if the token is a valid one.
    – Jos
    Jul 10, 2021 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.