I am using a plugin which makes its code publicly available.

Therefore, anyone can see the $action and $name parameters used to generate the nonces.

Does this make my site more vulnerable since this reduces the added security provided by these parameters? Should I thus replace these parameters with my own values for them?


  • I like the question because it is about being proactive for security so +1
    – prosti
    Oct 19 '16 at 20:38

Specific to nonce there is nothing to worry about as there is a third private parameter which is kept in secret (one of the keys added in your wp_config.php file).

In general, there is no such thing as "closed source", and all code can be read and interpreted by anyone that is willing to dedicate the time. The fact that it is easier for you to see how the code works do not make it by default better or worse security wise, and each case needs to be evaluated on its own merit.

In your case for example, the calculation of the nonce might be done perfectly but it might be made public because of some bug in the code.

  • Thank you. Isn't it like removing some of the security benefit though? The third private parameter is used whether an $action or $name parameter is passed or not. But what added benefit can I get from the $action or $name parameters if they're publicly known?
    – theyuv
    Oct 20 '16 at 6:27
  • The action parameter is there to add context to the nonce, so different nonce will be generated in different context, this helps to prevent the exposure of the nonce to people that might not be authorized to use them in different context. What is important is their uniqueness not there value. The name is just the name of the hidden input field in the request, and carries no security related value as any browser developer tool will discover it even if it was a secret. Oct 20 '16 at 6:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.