Member Avatar for surferbloggy

Hi, i'm doing a wordpress plugin that add some data from angularjs/json on each post
in the json angularjs request i have to pass the session id
i've found this code to set it

session_start();
$id = session_id();

but i don't know where to put it becouse if i add it in the function that print the data below the article post session_start() gives error where do i have to put the session_id() in a wordpress plugin? thank you for help

  • 2 Contributors
  • 2 Replies
  • 302 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by surferbloggy

Dani AI

Generated

Quick expert summary tied to the thread: encountered an error when trying to start a PHP session from the function that prints post content; pointed out the right idea (initialize the session earlier). Below are practical reasons, safer patterns for an Angular/JSON front end, and a concise troubleshooting checklist.

Why the error happens and the immediate fix
Starting a PHP session sends HTTP headers. If the theme or plugin has already begun output (template rendering, stray whitespace, BOM), attempting to start a session at that point triggers header-related errors. The reliable remedy is to initialize session handling early in the request lifecycle (before any output) and to avoid starting a session multiple times. Also confirm there is no stray whitespace or BOM in plugin files and check whether another plugin already started a session.

Safer, more scalable alternatives for Angular + JSON
Relying on a raw PHP session id in JSON is brittle and less REST-friendly. Preferred patterns:

  • For authenticated users, use WordPress authentication/cookies and server-side lookups of the current user rather than exposing session internals.
  • For AJAX, use WordPress nonces (wp_create_nonce + check_ajax_referer) or REST API authentication instead of passing a session id.
  • For anonymous visitors, issue a short random token, store it server-side (transient or a small table), and set a secure cookie. Have Angular send that token in an Authorization header or cookie. This is easier to scale and more secure than sharing PHP session IDs.

Security and troubleshooting checklist
Use HTTPS and set cookies Secure/HttpOnly/SameSite; regenerate tokens on login; never put session IDs in URLs; check server error logs for the exact warning; test with other plugins disabled to rule out conflicts. If a token needs to be exposed to client JS, pass it safely (for example with wp_localize_script or a dedicated REST endpoint) rather than embedding raw session internals.

Recommended Answers

All 2 Replies

Member Avatar for veedeoo

you can add it on your plugin or theme function. I don't have any time to actually check for my answer. However, I did this long time ago and this is how much I can recall.

Warning! *Please check the wordpress codex for validity of my wordpress syntax and make sure they are not deprecated. I did this long time ago and I haven't check on their updated documentation.
*
For example, if I have a plugin called veedeoo_plug and I want to register the PHP session for this plugin in wordpress global space, then I would code it something like this.

function my_session(){

     if(!session_id()){

         session_start();
     }
}

## we need to hook the above function with the wordpress.

add_action('init','my_session');

After adding the codes above, check if there are any errors. If no errors you can assign the session as you would assign them on regular php

$_SESSION['your_session'] = 'foo_bar';

for the add_action reference, please read here.

commented: nice work! +4
Member Avatar for surferbloggy

thank you yes this is the way in wordpress
later i'll tryed to make a more secure system with this tutorial
Click Here
bye

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.