WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've some trouble getting nonces working with my ajax submit form.

First of all i create a nonce and pass it to my registered script, i'll later send it to ajax-handler packed with my form fields:

wp_localize_script( 'roll_script', 'Roll', array(
                    'postRollNonce' => wp_create_nonce('nonce-roll')));

In my ajax-response handler i verify the nonce, do my stuff and try to create a new nonce to send back to js, for later submit:

        function on_ajax_roll(){
            if (!wp_verify_nonce($_POST['postRollNonce'], 'nonce-roll' )) die ('No allowed!');
// nonce is valid! do some stuff...     
            $r = array('postRollNonce' => wp_create_nonce('nonce-roll'));           
            $response = json_encode($r);
            header( "Content-Type: application/json" );
            echo $response;

...but, back to my js, the new nonce is exactly the same as the old one! Since nonce is supposed to change with time, why a second call to wp_create_nonce return the same string?

share|improve this question
up vote 5 down vote accepted

By default, the lifetime of a nonce is one day. The nonce is generated by concatenating a variable representing the current day, the user id, and the name of the action, and hashing the resulting string.

If you want the nonce value to change more frequently, you can filter the 'nonce_life' value. This function, for example, will force nonces to change every hour:

function nonce_hourly() {
    return 3600;
add_filter( 'nonce_life', 'nonce_hourly' );

But this doesn't sound exactly like what you're trying to do, either. You may have better luck generating the kind of one-time nonces you want by using a different name for the "action" value of the nonce, one that will be truly unique to the specific action you're trying to perform. It looks as though you're using "nonce-roll" as the action name for some distinct actions that you want to be able to check separately — maybe you can use a more specific action name for each action you're trying to perform and authorize.

share|improve this answer
ok, now it's definitively clear! tnx allot! – Gabriele B Apr 14 '11 at 19:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.