5

I am aware of the fact that we can alter nonce life time using filter , 30 seconds here:

add_filter( 'nonce_life', function () { return 30; } );

I have a logout() function for my rest api .I wish to expire a nonce that i created after successful login :$nonce = wp_create_nonce( 'login'.$user_id );

  • During login is not the right word. Nonce will be after login or before login ? – Sumit Apr 15 '16 at 19:14
  • 2
    Cool :) So IMHO you do not need to worry about it. Because after login nonce created using logged-in user's ID and after logout, ID become 0 then nonce verification will return false. If you wish you can test it! – Sumit Apr 15 '16 at 19:22
  • 1
    yw! Cheers.. ;) – Sumit Apr 16 '16 at 5:07
  • 1
    @sumit you are right, and you should post info in your comment as an answer, so the question can be marked as answered instead of stay un answered. – gmazzap Apr 16 '16 at 22:09
  • 1
    @gmazzap I am sorry I was away and now Caspar already answered that :) – Sumit Apr 19 '16 at 16:28
6

The problem with expiring a nonce is that in WordPress, nonces aren't nonces in the purest sense of the term: "number used once." Rather, a WP nonce is a (substring of a) hash of a string involving a time signature at the moment it was generated, among other things: user ID, the action name and your php session token. As such, once generated, it is what it is, it's "use-by" date is baked in, and you can't expire it (and you can't extend it).

Edit:

You can see how the nonce is built in wp-includes/pluggable.php:

function wp_create_nonce($action = -1) {
    $user = wp_get_current_user();
    $uid = (int) $user->ID;
    if ( ! $uid ) {
        /** This filter is documented in wp-includes/pluggable.php */
        $uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
    }

    $token = wp_get_session_token();
    $i = wp_nonce_tick();

    return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );

The same set of criteria are used in wp_verify_nonce(): nonce_tick (which is the time element), action, token and uid are all combined and hashed in the same order and compared to the submitted nonce. So, if any of these have changed, the hashes will not match and the nonce is rejected.

End Edit

WP validates it only by whether a submitted string time-matches (via php's hash_equals()) an expected value that is generated when you pass in the nonce string along with the action. If the nonce and action combine with your current user ID and session token to create a hash substring that matches the time-hash check, you pass.

What's missing to make a WP nonce a "true" nonce is a check to see if it has already been used/processed once before.

The security assumption is that it doesn't matter, because even if someone gets ahold of the nonce and its corresponding action, you would still need to submit it using the same User ID and php session token under which it was generated -- highly unlikely unless a hacker has hijacked your device and is logged in as you... but by then you have a different kind of security problem.

  • please sight a small example in yours answer about how a nonce can have session token among other things to clear my concern on how to handle expiring WP pseudo nonce – Divyanshu Jimmy Apr 19 '16 at 19:25
  • 2
    Edited to include how token is incorporated into nonce. – Caspar Apr 20 '16 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.