I have a form with the action going to a different wordpress site. I want to use wp_nonce to generate fields in the form on site A. Can I use wp_verify_nonce on site B to verify the nonce fields?

  • 1
    Can we kow what is your purpose? Why do you need that? – cybmeta Feb 4 '16 at 14:16
  • I need to determine if the user is arriving on Site B via Site A or not. So I'm using a form with the form action going to Site B, and then on Site B I was going to check if the form is sent etc... Is there a better way of doing this? – Luke Seall Feb 4 '16 at 14:31
  • 1
    If you just need to check the referrer, I think it is better to use (wp_get_referer())[codex.wordpress.org/Function_Reference/wp_get_referer] function. But if you want to performe some kind of access control, think neither nonces or referrer is what you need. – cybmeta Feb 4 '16 at 15:02
  • 2
    Agree with @cybmeta here, if you want to track where users are coming from, that scheme is pointlessly over complicated – Mark Kaplun Feb 4 '16 at 15:20
  • Ok, thanks for your help. I've abandoned the for Idea and going for referer. – Luke Seall Feb 5 '16 at 9:07

In theory yes, but it will be a very bad thing to do. For that you will need to have the secret used to generate the nonce at site A in site B which means tht if site B is compromised site A might be as well (there is also some time synchronization that needs to be done between the site, but that the lesser worry).

There are two ways to properly go about it

  1. don't use nonce at all. nonce are there to protect registered users and if the submitter of the form is unlikely to be registered or the form do not do anything destructive on the server, then no point in using them

  2. Site A should embed the form as an Iframe from site B. That way the nonce was generated by site B and it can verify it without knowing the secrets of site A

  • Thanks for reply. What is the safest way to send the form data from site A to site B? – Luke Seall Feb 4 '16 at 14:13
  • safe in what regard? iframe is most likely the safest especially if you put on it all kinds of security attributes, but to get an opinion about how safe things are, you will need to ask security experts. – Mark Kaplun Feb 4 '16 at 14:39
  • 1
    Well, the safiest method is to use the REST API over a OAuth server. That is why asked the reason of send data between sites. – cybmeta Feb 4 '16 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.