Switch Cookie & Session

What Happens During a Switch

1. The current user's ID and session are stored in a HMAC-signed cookie named switchguard_origin.
2. The HMAC signature uses a secret derived from the site's AUTH_KEY and the admin's user ID.
3. The cookie TTL is set from the Session Duration setting (default 48 hours, configurable 1–168 hours). If not switched back before the cookie expires, the origin is forgotten and you must log in again manually.
4. The target user's session is established via wp_set_current_user() and wp_set_auth_cookie().

Cookie Security

• The HMAC signature prevents forging a switch-back as a different admin.
• An attacker who intercepts the cookie cannot determine the origin admin's credentials from it.