I'm building a custom voting solution for my site that would allow public AJAX voting on multiple posts per page. Votes can be added/changed/revoked. Values are stored in custom post meta. I understand that I might need to use nonces but I have a few problems. The page will get cached by W3 Total Cache and obviously a new nonce will not get generated on every page load.

I'd imagine a separate AJAX request that asks for a nonce, and making the actual vote function use the retrieved nonce. But is this safe? Doesn't it defeat the purpose? Anyone could request a nonce this way, since the nonce request itself is not secured...

  • 3
    Do you want to use nonces for anonymous visitors? Why? – fuxia May 18 '15 at 10:39
  • 1
    I don't know. Shouldn't I? – Firsh - LetsWP.io May 18 '15 at 14:54
  • So something like this doesn't make any sense? adamcap.com/code/… – Firsh - LetsWP.io May 18 '15 at 18:16
  • 1
    If you're tracking your votes using a counter in a custom meta, I would strongly advise against this. Your data will be utterly unreliable due to race conditions ( if Alice votes for option 1, but Bob votes for option 2, the server hasn't finished updating for Alices vote but Bobs update grabs the value before it's update with Alices vote, then adds 1 to it, so now someones vote has been lost! ) – Tom J Nowell May 19 '15 at 13:39
  • What are the chances of two people voting on the same thing at roughly the same time? How/where should I count the votes instead? Add them to a log then count the log entries? – Firsh - LetsWP.io May 19 '15 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.