0

I created a plugin which use some ajax requests to load more posts on click. I noticed that when I use a cache plugin like W3 Total cache plugin then the wp_verify_nonce($nonce, $action) fail sometimes when I'm not loggin (since cache is disabled when loggin).

Because it's for a plugin, I must find a solution to solve this issue. Is there a way to make ajax request working with nonce verification and cache plugin. With W3 Total cache plugin even if I add some exception pages in Never cache the following pages it still cache the nonce values... but not the page itself. When the cache plugin is deactivated everything is working fine.

I spend days to try finding a solution but I didn't success. Even by adding constant, it still doesn't work (it's the same for fragment, html is not cached but nonce are cached) :

define('DONOTCACHEPAGE', true);
define('DONOTCACHEOBJECT', true);
define('DONOTCACHEDB', true);

I hope someone can help me with this issue because I spend so much days whithout success. By the way, the nonce is generated with wp_create_nonce and localize script as usual. And the nonce is verify with wp_verify_nonce.

Improve this question

1 Answer 1

Reset to default
2

basically you should not use nonce for non logged in users, and if you have to, then have page can not be cached otherwise users will think there is something wrong with the site. A middle ground is to have short time caching for like 1 minute but good luck with explaining that to most site owners, and it might make W3TC ineffective.

Improve this answer
3
  • Thank you for your answer. When you say that I should not use nonce for non logged in user, I'm not sure to understand why... When I looked at some plugins on repository, they always use verify nonce even for non loggin users on front end... Can you please just show me how a code how to deal with nonce and non loggin user for front end? Thank you again
    – freaky
    Commented Oct 9, 2015 at 13:41
  • Does making an if statement like this is safe on front end for non loggin user: if (!wp_verify_nonce($nonce, $action) && is_user_logged_in()) { die(); } else { do my stuff }. In my ajax request I only retrieve meta_data and post content like excerpt, link, images,... Nothing is updated or modifyied on the server.
    – freaky
    Commented Oct 9, 2015 at 14:19
  • coding by copy and paste is never a good idea. If you don't understand why and when nonce is used then you should read about it in order to know when and how to use it. This en.wikipedia.org/wiki/Cross-site_request_forgery is probably a good place to start understanding the problem nonces are supposed to solve and then hopefully it will be obvious that non logged in users can not usually be attacked that way.
    – Mark Kaplun
    Commented Oct 9, 2015 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.