Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document like so:

/* <![CDATA[ */
var nc_ajax_getpost = {
    ...stuff...
    getpostNonce: "8a3318a44c"
};
/* ]]> */

So if I was building a quick scrapper I would just get the nonce value from that page and then use it in my POST...making the whole exercise of using a Nonce useless...

What am I missing here?

share|improve this question
    
Nonces have nothing to do with content scraping, where had you got that idea from?.. –  Rarst Oct 28 '11 at 21:55
    
K so let me use a run-of-the-mill example then. Nonce is being used to prevent a security related attack...the attacker can still get the nonce from the website since it is being displayed publicly...wtf? –  Adrian Oct 28 '11 at 22:07
1  
It would probably make sense for you to rephrase this into more generic question about nonce. Way too much for comments and your initial wording about scraping does not apply. –  Rarst Oct 28 '11 at 22:36
add comment

2 Answers 2

up vote 10 down vote accepted

Nonces are unique to each logged-in user. You can't scrape a logged-in user's nonces unless you have their cookies. But if you have a user's cookies, you've already stolen their identity and can do whatever you want.

Nonces are meant to protect against users being tricked into doing something they didn't mean to do, by clicking a link or submitting a form. So they, themselves, perform this action (unintentionally), not the attacker.

share|improve this answer
    
Thank you that makes sense! –  Adrian Oct 28 '11 at 23:00
add comment

http://en.wikipedia.org/wiki/Cryptographic_nonce

"In security engineering, nonce is an arbitrary number used only once to sign a cryptographic communication. ... It is often a random ... authentication protocol to ensure that old communications cannot be reused in replay attacks. "

The idea is to stop the submitting of repeat data. You create a single-use unique identifier personal to you, so that when you submit data, it can only be done once. It has nothing to do with browsing your site. Which is what site scraping does. How would you differentiate between a scraping bot and a trawling bot (like Google)?

share|improve this answer
6  
I must note that (confusingly) WordPress nonces can be used more than once just fine. So it doesn't have anything to do with repeated submission either, it's about verifying intent of specific user doing specific action towards specific object. –  Rarst Nov 1 '11 at 18:52
2  
@Rarst - excellent point about nonce reuse, and saddly the comments in the source code and the codex itself indicate that it is one time use only key. codex.wordpress.org/Function_Reference/wp_create_nonce - Which sucks when you develop a feature assuming those numbers will not validate more than once. :( –  Marcus Pope Aug 16 '12 at 17:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.