Change name of "wp-settings-" and "wp-settings-time-" cookie

[Neustradamus]

There is no option to change the cookie names of:

• wp-settings-time-
• wp-settings-

Can you add options?
It will be nice to add in wp-config.php like other cookies?

Thanks in advance.

[birgire]

The related core (PHP) functions are:

• wp_clear_auth_cookie(): https://core.trac.wordpress.org/browser/tags/4.8.2/src/wp-includes/pluggable.php#L922-L965

• wp_user_settings(): [https://core.trac.wordpress.org/browser/tags/4.8.2/src/wp-includes/option.php#L792-L840

but it's more complicated than that, because it's hardcoded in the Javascript function setUserSetting(), where:

...
settings = wpCookies.getHash( 'wp-settings-' + uid ),
...
wpCookies.setHash( 'wp-settings-' + uid, settings, 31536000, path, '', secure );
wpCookies.set( 'wp-settings-time-' + uid, userSettings.time, 31536000, path, '', secure );
...

in /wp-includes/js/utils.js:

https://core.trac.wordpress.org/browser/tags/4.8.2/src/wp-includes/js/utils.js#L151-L184

There's also the getAllUserSettings() Javascript function that contains:

return wpCookies.getHash( 'wp-settings-' + userSettings.uid ) || {};

[petertoi]

Convert strings for wp-settings- and wp-settings-time- to constants

[petertoi]

This patch takes adds constants to replace usages of 'wp-settings-' and 'wp-settings-time-' in PHP and updates the localization of utils.js with variables to use these constants in JS. Let me know if this needs any modification, happy to make any changes.

Prepared this patch at WordCamp Toronto 2017 with assistance from @pbearne.

[petertoi]

As a side note, what's the standard approach to updating WordPress code style on patches? Is code style applied only to modified code or should it be applied to related blocks (ex: adding curly brackets to all the constants in constants.php instead just those we've added)?

[Neustradamus]

Thanks for your works! :)

It has been added in 4.9 release?

[petertoi]

Replying to Neustradamus:

It has been added in 4.9 release?

No, it hasn't been reviewed yet. And may need tests too. Now that 4.9 is out the door there's a good window to bring this up in the #core Slack channel and see what folks think is required to get it in a future release.

[petertoi]

Confirmed against updated coding standards. Updated @since.

[DrewAPicture]

Assigning to mark the good-first-bug as "claimed".

[Neustradamus]

It is possible to have in several WordPress branches (not only 4.9.x and trunk)?

[Clorith]

I would just like to drop a consideration here that may or may not affect cache solutions.

Tools, such as Varnish at least, will read the existence of a cookie as a call to not cache a page by default. It's therefore common to add in rules to filter out certain cookies, in which you need to know what those cookies are.

If we start making cookie prefixes dynamic, we may essentially be invalidating many caching solutions which would impact site performances.

(This may not be an issue, but without knowing the cache configs everyone uses we can't make certain, and as such need to be careful about these kind of changes)

[Neustradamus]

Any news about it?

[Neustradamus]

It will be in 5.0?

[Neustradamus]

Happy new year 2019 to all!

Any news on it?

[ka2]

This is a feature that we definitely want you to implement.

Because other cookie names can be changed with a constant, but I think that it is impairing the extensibility of WordPress that wp-settings- {time}-{UID} cannot be changed only.

[multidots1896]

HI @Neustradamus
Here we can checkout the updated cookies
screenshot:​https://prnt.sc/21ing63

[multidots1896]

changes name to cookies,updated config file