WordPress session management

9 comments

1. It’s a very bad idea to modify WP Core files for the ability to use sessions. The best way I’ve found is to call the session_start() from init action hook.

   function kana_init_session() {
     session_start();
   }
   
   add_action('init', 'kana_init_session', 1);
   

   You can place it in functions.php file of your theme.

   Detailed article can be found here: http://www.kanasolution.com/2011/01/session-variable-in-wordpress/

   Log in to Reply

2. WordPress doesn’t appear to call session_start() because it wants to be stateless
   and if register_globals is defined, it automatically destroys your $_SESSION

   Log in to Reply

3. Consider using WordPress Transient API

   Values stored using the Transient API are visible to all users, not just the current user, depending on the unique identifier used to retrieve the transient, you could assign each user a unique identifier essentially causing a transient to behave very much like a session.

   Further considerations:

   • Depending on a users setup with object cache, etc., transients may
     not always be stored in the DB (e.g. memcached), using transients for
     sessions could mean that the data can get bulky and fill memory
     quickly (in the use of memcached).

   • Also, it seems that WP does not do auto garbage collection for
     transients:
     https://wordpress.stackexchange.com/questions/6602/are-transients-garbage-collected

   Log in to Reply

4. For what I need to do, the best answer involves:

   1. To allow the cookie for wordpress to persist across subdomains, install the Root Cookie plugin.
   2. sub1.domain.com has wordpress; sub2.domain.com is another site. From the other site (sub2), I read the cookies to identify who the user is and if the user is logged in.

   My cookies are as follows:

   [wordpress_909bb230b32f5f0473202684d863b2e0] => mshaffer|1255298821|d0249fced9c323835c5bf7e84ad3ffea
   [wordpress_logged_in_909bb230b32f5f0473202684d863b2e0] => mshaffer|1255298821|56e9c19541ecb596a1fa0995da935700
   

   Using PHP, I can loop over the cookies, parse the key=>value pairs. These cookies let me know that [mshaffer] has a cookie stored on wordpress, and also is authenticated as logged_in. The expiry of the cookie is 1255298821.

   In sub2, I can query the database of wordpress and grab the user info:

   SELECT * FROM `wp_users` WHERE user_login = 'mshaffer' ... grab user_id, user_email from this query

   SELECT * FROM `wp_usermeta` WHERE user_id = '$user_id' ... grab lots of other data from wp

   With this info, I can add to my sub2 session variable / cookie and do what I want with the data. I can identify if I am logged in, and my username … which let’s me grab lots of different data. I can now use WordPress authentication in my sub2.domain.com and redirect accordingly.

   monte

   {x:

   Log in to Reply

5. WordPress doesn’t seem to use any sessions.

   The best way to go about it is to use the action hooks it provides.

   Log in to Reply

6. Have you checked the solution here this may work for here and its on easy way

   http://thedigilife.com/wordpress-how-to-set-session-custom-variable-while-login/

   Log in to Reply

7. Hooking a function with session_start() on wp_loaded seems to work in this case.

   Log in to Reply

8. Put this code in wp-config.php at first line:

   if (!session_id()) {
       session_start();
   }
   

   Put this code in theme’s header.php at first line:

   session_start();
   

   Then it will maintain all session variables.

   Log in to Reply

9. If you wanna use your own session values, WordPress does support it.

   You need to add following lines at the top of wp-config.php

   if (!session_id()) {
       session_start();
   }
   

   Then add following line at the top of header.php

   session_start();
   

   Log in to Reply