WP REST API - Nonce passes wp_verify_nonce even after logout

Question

I'm creating a single page app with WP REST API and AngularJS. After solving a problem with nonces on this question, now i'm facing something else. To test the chance of adding fields and making them protected against non-logged users, i tried to create a custom field which exposes the result of wp_verify_nonce

if (isset($_SERVER['HTTP_X_WP_NONCE'])) {
    $nonce = $_SERVER['HTTP_X_WP_NONCE'];
    $nonce_verified = wp_verify_nonce($_SERVER['HTTP_X_WP_NONCE'], 'wp_rest');
}

return array('nonce' => $nonce,
             'nonce_verified' => $nonce_verified);

Of course, this is a test and will remain so. Nonce is exposed and so is nonce_verified. At this point, i tried to login/logout a user and require this endpoint and users/me. But it happened that my nonce is always verified, either with logged in or logged out user. Nonce itself changes while doing this; still, when logged out, it's the same for all of its lifetime.

To create my nonce, i used a localized code as in my previous question:

wp_localize_script('angularjs', 'params', array(
    'nonce' => wp_create_nonce('wp_rest'),
));

which is passed through javascript, as i saw in a tutorial about AngularJS. Although this nonce gets validated, query to users/me leads to a 403 when not logged, as expected.

My theory is that a nonce for non-logged users is being created, so there is always a valid nonce available. Should i protect nonce creation with is_user_logged_in()? Or should i hook the nonce creation somewhere? Thank you.

Answer 1

The true reason of not using nonces for non logged in users, is that it adds a pointless burden on their usage as they need to refresh the page when the nonce expire, and the only way they will know that they need to do it is when something do not work.

There is probably no reason to avoid generating it, but if you expect that your "app" will be used/open for more then 12 hours (that is the "tick" time used to calculate wordpress nonces) then either you need to also have an automatic way to refresh the nonce (might be a good idea for logged in users as well) or avoid using it in the first place.

Answer 2

WordPress nonces are not real nonces, they remain valid for a period of 12 to 24 hours and will return the SAME value for all visitors (not logged in users) of the website. So you should NOT rely on WP nonces for security measures if you expect a new number for each action or you are working with guest users in your application.

I explain in depth how this works here: https://www.bynicolas.com/code/wordpress-nonce/

You might also want to take a look at this project https://github.com/calevans/wp-simple-nonce if you wish to add true nonces to your project

EDIT from the codex https://codex.wordpress.org/WordPress_Nonces

Nonces should never be relied on for authentication or authorization, access control.