Can you have more than one nonce on a page?

Question

I have a site with a page where there's one form in the sidebar, and one in the main body of the page. The sidebar comes first in the HTML.

Both forms have their own nonces (generated with wp_nonce_field) with different $action and $name parameters. The $referrer fields are on.

When I submit the second form, I get the usual "Are you sure you want to do this?" message.

If I remove the first form, things work correctly.

I added some debugging to wp_verify_nonce (var_dump statements and an exit;) and it's failing after a NULL $nonce and the $action of the first form (i.e. the one I haven't submitted.)

$_POST contains all of the second form, as you'd expect.

Any ideas?

Answer 1

This turned out to be a pretty straightforward bug with my own code.

The problem was my first form was checking for submission with a simple:

if ( 'POST' == $_SERVER['REQUEST_METHOD'] ) {

so it was being triggered even when the other form was submitted, and my wp_verify_nonce() check would fail and then it would call wp_nonce_ays.

To fix, I added this to the conditional:

and isset( $_POST['sidebar_form_wpnonce'] ) 

So yes, you can have more than one form/nonce per page.

Answer 2

If wp_verify_nonce is returning NULL after you have submitted the second form, it could be because the nonce value for the first form is not being passed to the server when the second form is submitted. This could be due to a number of reasons, such as the nonce field being left out of the form HTML or the form submission being handled via AJAX rather than a traditional HTTP request.

To troubleshoot this issue, you may want to check the following:

• Make sure that the nonce field is included in the HTML of the first form. Check that the nonce value being passed to wp_verify_nonce is the correct value for the first form.

• Check for any JavaScript errors that might be preventing the first form's nonce value from being submitted with the second form. Consider using the wp_localize_script function to pass the nonce value to the client-side script that handles the form submission if you are using AJAX to submit the form.