Description
When a logged-in user navigates to a frontend page from an external website (e.g., Google Search), ClassicPress may fail to recognize the user as logged in. The wordpress_logged_in_... authentication cookie is not included in the initial HTTP request, so is_user_logged_in() returns false, and the admin bar and other login-dependent functionality are missing.
Opening the exact same URL directly in another browser tab works correctly. The issue appears to be related to the SameSite=Strict attribute on the authentication cookie, which prevents the browser from sending it during cross-site navigation.
Steps to reproduce
-
Log in to a ClassicPress website.
-
Open Google Search and navigate to a page on the website by clicking a search result.
-
Observe that the frontend behaves as if the user were logged out: the admin bar is missing, and code depending on
is_user_logged_in()does not run as expected. -
Copy the URL of the same page and open it directly in another browser tab.
-
Observe that the admin bar and authenticated-user functionality work correctly.
Expected behavior
A logged-in user should remain recognized as authenticated when navigating to a frontend page from an external website, including search engines.
Actual behavior
The wordpress_logged_in_... cookie is missing from the request initiated by the external navigation. ClassicPress treats the request as unauthenticated, even though the user has a valid login session and the cookie is stored in the browser.
Environment
-
CMS: ClassicPress
-
Browser: Google Chrome
-
Authentication cookie:
wordpress_logged_in_... -
Suspected cause:
SameSite=Stricton the authentication cookie.
Additional observations
-
The issue occurs on the frontend, while the user remains logged in.
-
Opening the same URL in a separate tab works correctly.
-
The browser’s Application panel shows the same stored cookies, but the outgoing request headers differ.
-
WordPress does not appear to exhibit the same behavior under the same circumstances.
Suggested investigation
Please verify whether ClassicPress explicitly sets SameSite=Strict on authentication cookies and whether this differs from WordPress core.
If confirmed, consider using SameSite=Lax for the frontend login cookie. This would allow the cookie to be sent during top-level cross-site navigations using safe methods, such as clicking a Google Search result, while retaining protection against many cross-site request scenarios.
Please also verify whether the behavior is intentional and whether it was introduced by a recent change to cookie handling.