Switch Cookie & Session

What Happens During a Switch

1. SwitchUser stores your original account ID (and who started the switch) in a signed cookie named switchuser_origin.
2. The cookie is signed with HMAC-SHA256 using your site's WordPress auth salt (wp_salt( 'auth' )).
3. The cookie expires after the Session Duration (default 48 hours, 1–168 hours).
4. You're logged in as the target user with a normal WordPress login cookie.

Cookie Properties

• The signature stops anyone from editing the cookie to switch back into a different account.
• The cookie holds user IDs, not passwords or login credentials.