Skip to content

Commit

Permalink
cookies review
Browse files Browse the repository at this point in the history
cookies documents & links reviews #108
  • Loading branch information
AkireOrl committed Jan 20, 2023
1 parent 73fd425 commit d7d8074
Showing 1 changed file with 6 additions and 5 deletions.
11 changes: 6 additions & 5 deletions wordpress/cookies.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ You can find information on how to manage those for the most popular browsers he
- [Microsoft Edge](https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy)
- [Safari](https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac)
- [Opera](https://help.opera.com/en/latest/web-preferences/#cookies)
- [Brave](https://brave.com/privacy/browser/)

## User's Cookie

Expand All @@ -23,23 +24,23 @@ After login, WordPress sets the `wordpress_logged_in_[hash]` cookie, which indic

WordPress also sets a few `wp-settings-{time}-[UID]` cookies. The number on the end is your individual user ID from the users database table. This is used to customize your view of admin interface, and possibly also the main site interface.

The cookies length can be adjusted with the `auth_cookie_expiration` hook. An example of this can be found at [whats the easiest way to stop wp from ever logging me out](https://wordpress.stackexchange.com/questions/515/whats-the-easiest-way-to-stop-wp-from-ever-logging-me-out).
The cookies length can be adjusted with the `auth_cookie_expiration` hook. An example of this can be found at [what's the easiest way to stop wp from ever logging me out](https://wordpress.stackexchange.com/questions/515/whats-the-easiest-way-to-stop-wp-from-ever-logging-me-out).

### Non-Version-Specific Data

The actual cookies contain _hashed_ data, so you dont have to worry about someone gleaning your username and password by reading the cookie data. A _hash_ is the result of a specific mathematical formula applied to some input data (in this case your `user name` and `password`, respectively). Its quite hard to reverse a _hash_ (bordering on practical infeasibility with today’s computers). This means it is very difficult to take a _hash_ and _unhash_ it to find the original input data.
The actual cookies contain _hashed_ data, so you don't have to worry about someone gleaning your username and password by reading the cookie data. A _hash_ is the result of a specific mathematical formula applied to some input data (in this case your `user name` and `password`, respectively). It's quite hard to reverse a _hash_ (bordering on practical infeasibility with today’s computers). This means it is very difficult to take a _hash_ and _"unhash"_ it to find the original input data.

WordPress uses the two cookies to bypass the password entry portion of `wp-login.php`. If WordPress recognizes that you have valid, non-expired cookies, you go directly to the [WordPress Administration Screen](https://wordpress.org/support/article/administration-screens). If you dont have the cookies, or theyre expired, or in some other way invalid (like you edited them manually for some reason), WordPress will require you to log in again, in order to obtain new cookies.
WordPress uses the two cookies to bypass the password entry portion of `wp-login.php`. If WordPress recognizes that you have valid, non-expired cookies, you go directly to the [WordPress Administration Screen](https://wordpress.org/support/article/administration-screens). If you don't have the cookies, or they're expired, or in some other way invalid (like you edited them manually for some reason), WordPress will require you to log in again, in order to obtain new cookies.

## Commenter's Cookie

When visitors comment on your blog, they get cookies stored on their computer too. This is purely a convenience, so that the visitor wont need to re-type all their information again when they want to leave another comment. Three cookies are set for commenters:
When visitors comment on your blog, they get cookies stored on their computer too. This is purely a convenience, so that the visitor won't need to re-type all their information again when they want to leave another comment. Three cookies are set for commenters:

- `comment_author_{HASH}`
- `comment_author_email_{HASH}`
- `comment_author_url_{HASH}`

The commenter cookies are set to expire a little under one year from the time theyre set.
The commenter cookies are set to expire a little under one year from the time they're set.

## References

Expand Down

0 comments on commit d7d8074

Please sign in to comment.