How to verify a wordpress user at a servlet?

Question

I'd like to embed an ajax application into a wordpress site. The ajax application will communicate with servlets running on tomcat. Now the servlets need a way to verify if a request originates from a user that is logged in to wordpress. How does this commonly get solved?

AFAIK, wordpress is stateless and does not use sessions, which makes me curious how a logged in user in wordpress can be tracked. The second problem is, how can a servlet request wordpress to verify if a given user is still logged in?

Any advice is welcome, Thank you.

Answer 1

The only thing that you can do is read the cookies. And that will work only if you are using the same domain (or subdomain and the cookies are valid for all subdomains). The session cookie might not give you sufficient information, however. You can't read a PHP session from a Java app, and generally, you can't mix two applications that way.

As a little workaround, you can check with javascript who is the currently logged user (by finding the username in the DOM), and send that with ajax, but that is not secure at all.