1

In our project we allow users to buy a coupon ( WooCommerce product ) for some service. We save every coupon as a custom post type with all the customer data inserted during purchase.

We then via email send a link to download the coupon in PDF. We use WooCommerce PDF Invoices & Packing Slips plugin for generating PDFs and links are generated in this manner:

$url = wp_nonce_url( admin_url( 'admin-ajax.php?action=generate_wpo_wcpdf&template_type=Coupon-PDF&order_id=' . $order->id ), 'generate_wpo_wcpdf' );

The problem is obviously the lifetime of nonce. We would need to link to be active at least one year, meaning that we should set the nonce to 2 years. I did quite some research but could not find proper information.

Question is: what is the maximum lifetime for nonce?

Additionally: It would be great it somebody shared their experiences with extending nonce lifetime by a lot, like in this case.

2
  • "We save every coupon as a custom post type with all the customer data inserted during purchase." - given this, why even bother with a nuclear nonce? Just run a routine every day that goes through the active posts and turns any off that are expired.
    – C C
    Aug 30, 2016 at 13:41
  • You can roll your own nonce and set the time to whatever you want - wordpress.stackexchange.com/a/212316/84219
    – jgraup
    Aug 30, 2016 at 19:53

1 Answer 1

1

As time varies, WordPress needs to allow for a nonce generated at 10:01 AM to be valid at 10:02 AM. It does this by using a time “tick” instead of the actual time, which is generated in two steps:

  • First divide the lifespan of a nonce, in seconds, by two
  • Divide the Unix timestamp by the above value, and round it up using ceil()

By default, the lifespan is 86400 seconds, or 24 hours (and can be adjusted with the nonce_life filter). Half this, 12 hours, is 43200.

Nonce time caveat Based on a 24-hour lifespan, a “tick” as calculated above is the same for each 12-hour span of a day. At 07:45 AM the “tick” is the same as 9:30 AM and 11:59 AM. But it will be one less than a “tick” created at 12:01 PM (a new 12-hour span within the day) or 15:30 PM.

Because of this, a WordPress nonce is not valid for exactly 24-hours from the moment that it was created, but up to 24 hours, depending how far into a 12-hour period a nonce was created.

Further reading: https://medium.com/myatus/wordpress-caching-and-nonce-lifespan-bb357d984da9

4
  • Also, here's another good reading about nonce -> tipsandtricks-hq.com/introduction-to-wordpress-nonces-5357
    – Josip Ivic
    Aug 30, 2016 at 9:33
  • I do understand that and already wrote that we need minimum lifetime of 1 year, meaning we will have to set the nonce lifetime to 2 hours. Question is about the maximum value and it's drawbacks.
    – Domas
    Aug 30, 2016 at 10:54
  • Josip, thank you for trying to help, but I do know how to create nonces. It would be very good if you knew the maximum liftime of nonces or are there none? If there is none, it would be great if you shared any good/bad experiences when extending nonce lifetime for so long.
    – Domas
    Aug 30, 2016 at 11:16
  • @domas maybe late, but still relevant to the discussion. I wrote an article explaining in depth how a wordpress nonce works and how to use it. Check it out if you wish to further understand the concept. Cheers
    – bynicolas
    May 18, 2017 at 21:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.