I am trying to integrate an external site with magento, so that when a user logs into site A, magentos session cookie gets set.

Currently I am doing this:

$email = $_POST["email"];
$password = $_POST["password"]; // not the same as magento password

//Validation.... sets that user is logged in in $_SESSION
//login writes to $_SESSION
$success = login($username, $password);

if(!$success)die("Wrong credentials");
Mage::getSingleton('core/session', array('name' => 'frontend'));
$customer = Mage::getModel("customer/customer");
$session = Mage::getSingleton("customer/session");

//User is now logged in, redirect somewhere else
header("Location: home.php");

the problem is if I write to the session before magento starts it's magic, magento won't write to its cookie, and if I start magentos session before validation I can no longer write to $_SESSION and have it persist to the next (non-magento) page.

So, is there any way I can log a user into magento from outside magento, and not ruin my session?

  • Yes you can creare webservice
    – Keyul Shah
    Commented Feb 12, 2014 at 17:47
  • Yes, thank you for elaborating, I know magento has a webservice, but I need the customer to log into magento externally (I.e. without their magento password, just id, they are being athenticated elsewhere)
    – user5212
    Commented Feb 12, 2014 at 17:53
  • require_once("/path/to/mysite/magento/app/Mage.php") has a syntax error, is that in your script?
    – benmarks
    Commented Feb 12, 2014 at 20:13
  • no, I Forgot the semicolon
    – user5212
    Commented Feb 12, 2014 at 20:43

2 Answers 2


Magento unfortunately needs to own the session start. However, there is no reason that you cannot manipulate $_SESSION directly as long as you:

  1. let Magento start the session first
  2. do not manipulate anything under one of Magento's session namespaces (e.g. $_SESSION['customer'])


//ensure you are getting error output for debug
error_reporting(E_ALL | E_STRICT);

//$email = $_POST["email"];
//$password = $_POST["password"]; // not the same as magento password


Mage::getSingleton('core/session', array('name' => 'frontend'));
$customer = Mage::  getModel("customer/customer");

//login writes to $_SESSION
//login($username, $password);

$customer->loadByEmail(/* try with a known email address */);
$session = Mage::getSingleton("customer/session");

    $_SESSION['foo'] = "I'm in ur session.";
    echo 'No foo yet; refresh!';
} else {
    echo $_SESSION['foo'];

The answer I came up with (convoluted as it is) is:


login($_GET["username"], $_GET["password"]);

//These next few lines make me uneasy, but I can't remove the existing session code for magento
session_write_close(); // Write the data, end session
unset($_SESSION); // unset the session, magento uses isset($_SESSION) to check if it
                  // should start a session
session_name("frontend");// change the session name to frontend

Mage::getModel('core/session', array('name' => 'frontend'));
$customer = Mage::getModel("customer/customer");
$sess = Mage::getSingleton("customer/session");

I also was playing with having a intermediate loginToMagento.php page on the site that would log into magento avoiding starting a session, but that was a gross solution.

I would have gone with @benmarks solution but the existing session code was too ingrained into the site to avoid calling session_start() before magento started

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.