Going to call my two sites "identity provider" and "WordPress site".

Flow is:

  • User logs in on identity provider
  • User is redirected to Wordpress site with an SSO token in the URL parameter. SSO token is used to hit the API, and two cookies are set
    • One cookie contains first name
    • One cookie contains membership status (true/false)
  • On logout, both cookies are deleted

Would adding an "accept cookie" bar with appropriate info before saving cookies be a viable solution?

  • What happens if one of those cookies is missing (deleted by the user)? Is your website still working with just one of those cookies? Is the first name always the real first name, or can the user choose an alias? – wimh Jun 1 at 9:38
  • 1
    Found this handy guide. I believe my cookies fall under the "clearly exempt from consent" category, as they are used for authentication functionality and expire at session end. – AakLak Jun 1 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.