Setting Cookie with init hook causes ‘header already sent’

Based on research here and elsewhere, I have the following code that sets a cookie on a site: add_action( ‘init’, ‘my_set_cookie’,1 ); function my_set_cookie() { if (! $_COOKIE[‘mycookie’]) { $guid = ‘xxxx’; // normally a real guid value so it will be unique setcookie(‘mycookie’, $guid, time()+(3600*24*30),”https://wordpress.stackexchange.com/”); } return; } But even though the init hook … Read more

Set cookies for cross origin requests

How to share cookies cross origin? More specifically, how to use the Set-Cookie header in combination with the header Access-Control-Allow-Origin? Here’s an explanation of my situation: I am attempting to set a cookie for an API that is running on localhost:4000 in a web app that is hosted on localhost:3000. It seems I’m receiving the … Read more

Is there a setting on Google Analytics to suppress use of cookies for users who have not yet given consent

According to EU Article 5(3) of the E-Privacy Directive (a.k.a ‘The Cookie Laws’), web sites that target EU users have to gain opt-in consent from users before they set a cookie. See ICO Guidance I am trying to square this with Google Analytics on my web site. I would imagine that Google Analytics (GA) can … Read more

Correct way to delete cookies server-side

For my authentication process I create a unique token when a user logs in and put that into a cookie which is used for authentication. So I would send something like this from the server: Set-Cookie: token=$2a$12$T94df7ArHkpkX7RGYndcq.fKU.oRlkVLOkCBNrMilaSWnTcWtCfJC; path=/; Which works on all browsers. Then to delete a cookie I send a similar cookie with the … Read more

JWT vs cookies for token-based authentication

I read some posts about “JWT vs Cookie” but they only made me more confused… I want some clarification, when people talking about “token-based authentication vs cookies”, cookies here merely refer to session cookies? My understanding is that cookie is like a medium, it can be used to implement a token-based authentication(store something that can … Read more

Configuring WordPress Auth Cookie Expiration

I’m trying to configure the WordPress cookie expiration time, but for some reason it’s not working. I went here: auth_cookie_expiration And put the following hook based on the doc: function init() { // … $expiration = 60; apply_filters( ‘auth_cookie_expiration’, $expiration ); } This code is called from a hook in my plugin’s constructor: add_action( ‘init’, … Read more