0

I create nonce as

$nonce = wp_create_nonce("action");

And then send the email with nonce to user. In the email there is the link to a page. In the page I form the nonce the same way and try to verify it using

wp_verify_nonce($nonce, "action");

, and it doesn't work, it always fails to verify, and returns false. What am I doing wrong?

Improve this question

1 Answer 1

Reset to default
2

What you are doing wrong is using nonce in a context it was not intended to be used in. nonces should be used on web pages for logged in users, not just a random "it has something to do with security so it has to be right" kind of measure ;).

If you need to validated the authenticity of the link you have sent, just use an md5 hash (or any other hash generator) based on whatever long term "secret" information you have on the user. At the best case, nonces "live" for 48 hours, while emails might be opened later then that.

Improve this answer
10
  • So for nonce to work, the user has to be logged in?
    – Vladimir Despotovic
    May 30, 2017 at 15:00
  • I tried to go to the same page that does the verification logged in, and it still doesn't verify the nonce.
    – Vladimir Despotovic
    May 30, 2017 at 15:03
  • I need to secure the page that only the user that I sent the email to can access what I want him to access. You suggest I should store the md5 value somewhere manually, instead of using nonce native wordpress functionality?
    – Vladimir Despotovic
    May 30, 2017 at 15:12
  • 1
    it does not validate because the user used at nonce generation is probably not the one used when you access the page, therefor nonce will fail. You can probably work around it but in the end of the day it is just the wrong way to do this
    – Mark Kaplun
    May 30, 2017 at 15:22
  • 1
    just use md5 it is not the best, but doesn;t sound like you need high level of security. The issue you are facing is specific to how wordpress generates and validates nonces. If it was truly a "one time value", you could have used the API, but since it is not, and the values are time limited, it is just not appropriate to anything which might not happen "right now"
    – Mark Kaplun
    May 30, 2017 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.