wp_verify_nonce not working

Question

I'm working on an ajax request, I have several ajax requests on my functions.php. And all are working, but this:

On my php I have this:

add_action("wp_ajax_fb_points", "get_fb_points");
add_action("wp_ajax_nopriv_fb_points", "get_fb_points");

function get_fb_points(){
    if ( !wp_verify_nonce($_REQUEST['nonce'], 'fb_points_nonce')) {
        exit('No naughty business');
    }
    echo 'yeah';
    die();
}

On the footer.php I have this:

FB.Event.subscribe('edge.create',
    function(response) {
        if(response == '<?php echo get_facebook_profile('link'); ?>') {
            $.ajax({
                url: '<?php echo admin_url('admin-ajax.php'); ?>',
                data: { action: 'fb_points', challenge : 2, nonce : '<?php echo wp_create_nonce('fb_points_nonce'); ?>' },
                async: false,
                success: function(data){
                    console.log(data);
                }
            });
        }
    }
);

But I don't know why it isn't working the request response is "No naugty business". Can anyone help me to find out what is wrong?

Answer 1

I don't know I just submitted the ticket on track. I was using get_current_user_id() and it modifies the wp_create_nonce behavior.

Sinces wp_create_nonce uses wp_get_current_user() I think there is the problem.

Answer 2

When passing data using ajax I prefer to use check_ajax_referer instead of wp_verify_nonce.

B.Event.subscribe('edge.create',
    function(response) {
        if(response == '<?php echo get_facebook_profile('link'); ?>') {
            $.ajax({
                url: '<?php echo admin_url('admin-ajax.php'); ?>',
                data: { action: 'fb_points', challenge : 2, _ajax_nonce : '<?php echo wp_create_nonce('fb_points_nonce'); ?>' },
                async: false,
                success: function(data){
                    console.log(data);
                }
            });
        }
    }
);

function get_fb_points(){
    check_ajax_referer( 'fb_points_nonce');
    echo 'yeah';
    die();
}

I believe your method is not working because you are using $_REQUEST instead of $_POST.

function get_fb_points(){
    $nonce = $_POST['nonce'];
    if ( !wp_verify_nonce( $nonce, 'fb_points_nonce')) {
        exit('No naughty business');
    }
    echo 'yeah';
    die();
}