0

This is more of a security question. I have a blog layout that has a loader at the bottom of my posts, and when you get to it, ajax call will be triggered, it will call the function that will render more posts.

This all works. But one thing is bothering me: should I use POST or GET method? the GET won't trigger nonce issues when doing code sniffing using phpcs, while with POST I get the

Processing form data without nonce verification

error.

Now, all I am doing is fetching posts from the database by calling the callback function that is hooked to wp_ajax and wp_ajax_nopriv actions.

Should I be worried about security in this case, and append a nonce field in my blog, or should I just use GET method instead?

  • I don't understand: Nonces are for users who are logged in only. Why do you want to use one for anonymous users? They'd get all the same nonce. – fuxia Nov 24 '16 at 11:32
  • The thing is, normally I wouldn't when just loading posts (I'm not submitting any form to the server, only fetching posts). But Was just wondering should I use GET or POST when loading, and how to solve the issue that code sniffer requires nonce validation any time I use POST? – dingo_d Nov 24 '16 at 11:34
  • That is, is there a proffered method, when using ajax to fetch posts? – dingo_d Nov 24 '16 at 11:36
  • If you just want to get more posts, use GET. Use POST if you want to store data. And then you need additional security measures. – fuxia Nov 24 '16 at 11:37
  • Thanks. I never knew what exactly should I use, since I can get posts using both methods successfully. I mean it makes sense to use GET, but I read that GET isn't secure as POST is, so that got me worried a bit... – dingo_d Nov 24 '16 at 11:39
1

GET puts all your params on the URL like;

http://example.com/thing?foo=bar&x=y

For POST you could include all that information but it won't show in the URL.

http://example.com/thing

Obviously if you're thinking about security, using POST is more ideal because your params won't show in access logs or accidentally picked up by search engines or whatever. Sending passwords using this method is ideal in additional to large amounts of data.

But what you can loose with POST is caching. Some systems will not cache a POST. Assuming you want to ditch the the cache on a GET request you can always throw on a cache buster.

http://example.com/thing?foo=bar&x=y&cache=234234234

Where &cache=<current-time-or-random-number>. And maybe that's what you want for your more posts. To not cache them so you're always getting the freshest of the fresh. Unfortunately if you do anything at scale this idea fails. Cache is King and controlling the cache is ideal.

Enter the TTL (Time to Live) where you can add how long you'd like your resource to be cached on the other end.

header('Expires: '.gmdate('D, d M Y H:i:s \G\M\T', time() + (60 * 60))); // 1 hour

or nocache_headers() // no caching

Now, for your case, I don't think it matters one bit which one you use. But the questions to ask yourself should include;

  • Do you want to expose your data passed to the URL?
  • Should you be concerned with caching?
  • How can you control caching to make it optimized for your content and system?
  • 1
    Thanks for the comprehensive explanation on the pros and cons. I'll see about caching. – dingo_d Nov 24 '16 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.