I'm writing a plugin which adds a class that creates an endpoint for third party software to make API calls to and check if the current user is logged in. Here's a stripped down version of what I'm doing.

class API_Endpoint{

    public function __construct(){
        add_filter('query_vars', array($this, 'add_query_vars'), 0);
        add_action('parse_request', array($this, 'sniff_requests'), 0);
        add_action('init', array($this, 'add_endpoint'), 0);


    //other functions...

    protected function send_response($msg, $uid = ''){

        global $current_user;

        $uid1 = get_current_user_id();
        $uid2 = $current_user->ID;

        $response['message'] = $msg;
        $response['uid1'] = $uid1; //always = 0
        $response['uid2'] = $uid2; //always = 0
        $response['login_status'] = ( is_user_logged_in() ) ? TRUE : FALSE ; //always = false
        header('content-type: application/json; charset=utf-8');
        echo json_encode($response)."\n";
        exit; //prevents the rest of Wordpress from running....

new API_Endpoint();

I'm logged in when I test this... As you can see from the comments in the code, $current_user doesn't seem to be defined, nor is is_user_logged_in() working. Any ideas why? It's my understanding that these should be working by the time of the init action hook.

1 Answer 1


One question: is the 3rd party that's sending the request passing a user cookie?

If not, then WP will treat the request like any other guest! If it is, have you inspected $_COOKIE when send_response() runs?

Update: Thought I'd try and wrap up the discussion below, once and for all :)

You'll have to maintain a database log of signed-in users

I thought WP was doing that already!

No, WP simply validates the cookie (if one was sent) on each request.

I thought the cookies were stored in the browser


So if the same user is logged into my site, and then visits the sub-domain site, which calls file_get_contents(), why aren't the cookies there?

Because the API request originates from the server, not the browser. That's like asking why you're not logged in with Chrome after you signed in using Firefox!

I'd like to retract my suggestion about maintaining a log of sign-ins, since I believe there are two better, easier solutions;

  1. Fire the request on the client-side (i.e. with AJAX) - since it originates from the user's brower, the cookies are sent along as you would expect
  2. Send the user's cookie along with your API request on the server side* (see below)

Example code for sending remote get with client's cookies:

$data = array();

if ( ! empty( $_SERVER['HTTP_COOKIE'] ) ) {
    foreach ( explode( '; ', $_SERVER['HTTP_COOKIE'] ) as $pair )
        $data['cookies'][] = new WP_Http_Cookie( $pair );

// Wp_Http_Cookie will choke if cookie value has special characters.
add_filter( 'wp_http_cookie_value', 'rawurlencode' );

if ( $get = wp_remote_get( $url, $data ) ) {
    // Yippee!

However, 2) comes with a catch; the cookies needed to validate the API request must be sent to the script that fires it (the mention of subdomains flags a potential problem here).

If you're using MultiSite with subdomains, this is taken care of. Otherwise, you'll need to force the cookie domain in your wp-config.php:

 define( 'COOKIE_DOMAIN', '.example.com'  );

See that dot prefix? This indicates that the cookie should be sent to the domain or any of it's subdomains (whereas by default, WP will set it to apply only to the main domain).

  • @DeadMedic: The 3rd party is not sending a cookie. Just a file_get_contents(). I did print out $_COOKIE from inside send_response() and it's empty. What does that tell us? Commented Jul 27, 2012 at 0:58
  • How solid is your understanding of HTTP? Or cookies for that matter? Be honest, no judgement here :) Commented Jul 27, 2012 at 1:15
  • I'd say my understanding is "medium". Should I not expect to see WP's cookies with: var_dump($_COOKIE);? Commented Jul 27, 2012 at 14:50
  • Maybe I misunderstood your previous question. The 3rd party has their own cookies/authentication which will take over while users are on their subdomain. If the user isn't logged in, they'll be redirected to my site's login page. Does that make more sense? Commented Jul 27, 2012 at 15:01
  • Either way, if the 3rd party that's making the request doesn't send the user's cookie, the response will act as if no user is logged in - WordPress has no "memory" of who is/isn't signed-in, the cookie is the key! Commented Jul 28, 2012 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.