Switch Cookie & Session

What Happens During a Switch

1. The current user's ID and session are stored in a HMAC-signed cookie named switchguard_origin.
2. The HMAC signature uses a secret derived from the site's AUTH_KEY and the admin's user ID.
3. Cookie TTL is 172,800 seconds (48 hours). If not switched back within 48 hours, the origin is forgotten and you must log in again manually.
4. The target user's session is established via wp_set_current_user() and wp_set_auth_cookie().

Cookie Security

• The HMAC signature prevents forging a switch-back as a different admin.
• An attacker who intercepts the cookie cannot determine the origin admin's credentials from it.