Question

I wonder what’s the reasons of cookie login problems in most PHP scripts like WordPress?

This is common a problem in WordPress login page and a lot of other PHP scripts. Sometimes you can’t login, and it tells you to clear the browser cookie data.

What things can cause this problem and how to avoid it in our web application development?

Answer 1

That’s a pretty broad question. Personally I’ve not experienced it with WordPress, but it is possible: the set of cookies allocated to the user end up in a conflicted state, and the program doesn’t know how to proceed.

For example, imagine that we set a cookie when logged in, called “login”, which contains a username. And let us say that we set a cookie when logging out, called “logout”, and we delete the “login” cookie. Now, if we are on the login screen, and the program receives both cookies, then it is clear it shouldn’t fail – the “login” cookie can be ignored. But it might be the case that some applications get confused, and raise errors in these apparently conflicting circumstances. The job of the developer is, as always, to program defensively, so it still works as much as possible, even with unexpected input.

As I say, I’ve not experienced it with WordPress, but I recently discovered WP is probably more susceptible to it, since it doesn’t use sessions – just cookies. One WP host I found doesn’t support $_SESSION at all, since it is tricky to implement across a hosting farm. Now, with a session, if you unset a value, it will disappear, since you have control over it on your server. But with a cookie, if you unset a value, it is just a request, and a browser may not honour it, or a client-side time setting may incorrectly allow a dead cookie to persist.