title: WordPress wp_signon() succeeds but no cookie is attached to response header
body: <p>I am troubleshooting a problem with a WordPress front-end user login form. The code works great with the same site on a development server, but not on the production server.</p>
  
  <p>On the production server, the authentication passes, and the wp_signon() returns a full user object, however the cookie is not being inserted into the response stream. </p>
  
  <p>The following code demonstrates this:</p>
  
  <pre><code>$user = wp_signon( '', $secure_cookie );
  var_dump($user);
  </code></pre>
  
  <p>When using Fiddler to sniff the packets, this is what is returned by the production server:</p>
  
  <pre><code>HTTP/1.1 302 Found
  Server: cloudflare-nginx
  Date: Fri, 24 May 2013 07:53:01 GMT
  Content-Type: text/html; charset=UTF-8
  Connection: keep-alive
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  X-Pingback: http://www.domain.com/blog/xmlrpc.php
  X-Frame-Options: SAMEORIGIN
  Location: http://www.domain.com/log-in/
  Vary: Accept-Encoding,User-Agent
  X-Cacheable: YES:FORCED
  X-Varnish: 1753703763
  Age: 0
  Via: 1.1 varnish
  X-Cache: MISS
  CF-RAY: 73868e9b8da0418
  Content-Length: 802
  
  object(WP_User)#329 (7) {
  ["data"]=&gt;
  object(stdClass)#388 (10) {
  ["ID"]=&gt;
  string(2) "53"
  ["user_login"]=&gt;
  string(14) "SubscriberTest"
  ["user_pass"]=&gt;
  string(34) "$P$B8O8w6awJnKrHNoFLOyHJHfKiPE1nt/"
  ["user_nicename"]=&gt;
  string(14) "subscribertest"
  ["user_email"]=&gt;
  string(33) "SubscriberTest@domain.com"
  ["user_url"]=&gt;
  string(0) ""
  ["user_registered"]=&gt;
  string(19) "2013-05-23 05:56:42"
  ["user_activation_key"]=&gt;
  string(0) ""
  ["user_status"]=&gt;
  string(1) "0"
  ["display_name"]=&gt;
  string(14) "SubscriberTest"
  }
  ["ID"]=&gt;
  int(53)
  ["caps"]=&gt;
  array(1) {
  ["subscriber"]=&gt;
  bool(true)
  }
  ["cap_key"]=&gt;
  string(15) "wp_capabilities"
  ["roles"]=&gt;
  array(1) {
  [0]=&gt;
  string(10) "subscriber"
  }
  ["allcaps"]=&gt;
  array(3) {
  ["read"]=&gt;
  bool(true)
  ["level_0"]=&gt;
  bool(true)
  ["subscriber"]=&gt;
  bool(true)
  }
  ["filter"]=&gt;
  NULL
  }
  </code></pre>
  
  <p>The WordPress control panel login still works and the cookie is inserted when signing into the backend.</p>
  
  <p>The production server is also using CloudFlare, but I am not sure if that could be related or not. I have sent a support ticket to Cloud Flare as well, hoping that they can confirm whether their proxy service might be stripping them off.</p>
  
  <p>Here is what the response header portion looks like on my development server when running the same code. In this one you can see that the cookie is being sent:</p>
  
  <pre><code>HTTP/1.1 302 Found
  Date: Fri, 24 May 2013 02:18:23 GMT
  Server: Apache/2.2.22 (Ubuntu)
  X-Powered-By: W3 Total Cache/0.9.2.11
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  X-Pingback: http://domain.com/blog/xmlrpc.php
  X-Frame-Options: SAMEORIGIN
  Set-Cookie: wordpress_548d950a57c83d7fc5c2eb781062ef26=SubscriberTest%7C1369534704%7C08d4578ca9049beadffa39e0be0ea941; path=/blog/wp-content/plugins; httponly
  Set-Cookie: wordpress_548d950a57c83d7fc5c2eb781062ef26=SubscriberTest%7C1369534704%7C08d4578ca9049beadffa39e0be0ea941; path=/blog/wp-admin; httponly
  Set-Cookie: wordpress_logged_in_548d950a57c83d7fc5c2eb781062ef26=SubscriberTest%7C1369534704%7Cc41eb224ebec7f57982d0f93e70f7cff; path=/; httponly
  Set-Cookie: wordpress_logged_in_548d950a57c83d7fc5c2eb781062ef26=SubscriberTest%7C1369534704%7Cc41eb224ebec7f57982d0f93e70f7cff; path=/blog/; httponly
  Location: http://domain.com/
  Vary: Accept-Encoding
  Content-Length: 0
  Keep-Alive: timeout=5, max=100
  Connection: Keep-Alive
  Content-Type: text/html; charset=UTF-8
  </code></pre>