Should nonce be sanitized?

Question

The general guideline is that we should sanitize all user input before using them.

Now my questions is whether this applies to nonce or not.

Which one is correct?

wp_verify_nonce( sanitize_text_field( $_GET['some_nonce'] ), 'some_nonce' );

or

wp_verify_nonce( _GET['some_nonce'], 'some_nonce' );

Answer 1

Sanitizing is required when you are inserting user input into Database or outputting it in HTML etc. Here, you are simply doing a String comparison.

wp_verify_nonce function checks $nonce value like this:

if ( hash_equals( $expected, $nonce ) ) {
    return 1;
}

For this you don't need sanitizing. So the following is fine:

wp_verify_nonce( $_GET['some_nonce'], 'some_nonce' );