What exactly does 'authenticated' mean for wp_ajax_nopriv?

Question

When building AJAX functionality for WP, I've always thought 'wp_ajax_nopriv' was meant for non-admin users. But now I have gone and read the documentation and it says it is for non 'authenticated' users.

So now I am confused a little bit since WP does not, by default, provide an AJAX url for the frontend.

So when they say 'authenticated' users do they mean ANY user who has logged in or just the admin when referring to the wp_ajax functionality?

Answer 1

Authenticated here means according to the is_user_logged_in() function, i.e. if the user is logged in or not, no matter the user role.

This part from the admin-ajax.php file, explains it all:

if ( is_user_logged_in() ) {
        /**
         * Fires authenticated AJAX actions for logged-in users.
         *
         * The dynamic portion of the hook name, `$_REQUEST['action']`,
         * refers to the name of the AJAX action callback being fired.
         *
         * @since 2.1.0
         */
    do_action( 'wp_ajax_' . $_REQUEST['action'] );
} else {
        /**
         * Fires non-authenticated AJAX actions for logged-out users.
         *
         * The dynamic portion of the hook name, `$_REQUEST['action']`,
         * refers to the name of the AJAX action callback being fired.
         *
         * @since 2.8.0
         */
    do_action( 'wp_ajax_nopriv_' . $_REQUEST['action'] );
}