1

I'm creating a single page app with WP REST API and AngularJS. After solving a problem with nonces on this question, now i'm facing something else. To test the chance of adding fields and making them protected against non-logged users, i tried to create a custom field which exposes the result of wp_verify_nonce

if (isset($_SERVER['HTTP_X_WP_NONCE'])) {
    $nonce = $_SERVER['HTTP_X_WP_NONCE'];
    $nonce_verified = wp_verify_nonce($_SERVER['HTTP_X_WP_NONCE'], 'wp_rest');
}

return array('nonce' => $nonce,
             'nonce_verified' => $nonce_verified);

Of course, this is a test and will remain so. Nonce is exposed and so is nonce_verified. At this point, i tried to login/logout a user and require this endpoint and users/me. But it happened that my nonce is always verified, either with logged in or logged out user. Nonce itself changes while doing this; still, when logged out, it's the same for all of its lifetime.

To create my nonce, i used a localized code as in my previous question:

wp_localize_script('angularjs', 'params', array(
    'nonce' => wp_create_nonce('wp_rest'),
));

which is passed through javascript, as i saw in a tutorial about AngularJS. Although this nonce gets validated, query to users/me leads to a 403 when not logged, as expected.

My theory is that a nonce for non-logged users is being created, so there is always a valid nonce available. Should i protect nonce creation with is_user_logged_in()? Or should i hook the nonce creation somewhere? Thank you.

2 Answers 2

0

The true reason of not using nonces for non logged in users, is that it adds a pointless burden on their usage as they need to refresh the page when the nonce expire, and the only way they will know that they need to do it is when something do not work.

There is probably no reason to avoid generating it, but if you expect that your "app" will be used/open for more then 12 hours (that is the "tick" time used to calculate wordpress nonces) then either you need to also have an automatic way to refresh the nonce (might be a good idea for logged in users as well) or avoid using it in the first place.

1
  • I suppose the key words are "No nonces without authentication". So, i should protect its generation with this condition. Thanks. Aug 25, 2017 at 14:35
1

WordPress nonces are not real nonces, they remain valid for a period of 12 to 24 hours and will return the SAME value for all visitors (not logged in users) of the website. So you should NOT rely on WP nonces for security measures if you expect a new number for each action or you are working with guest users in your application.

I explain in depth how this works here: https://www.bynicolas.com/code/wordpress-nonce/

You might also want to take a look at this project https://github.com/calevans/wp-simple-nonce if you wish to add true nonces to your project

EDIT from the codex https://codex.wordpress.org/WordPress_Nonces

Nonces should never be relied on for authentication or authorization, access control.

7
  • "So you should NOT rely on WP nonces for security measures" seriously? citation needed Aug 25, 2017 at 13:19
  • The concept of WP nonces is to validate a known user's action. Not to validate an action on a site that is not from an authenticated user. For this you need a true nonce application. I edited the answer with a link to the citation. Granted that the use of security here is a bit too broad but still. WordPress nonces are not true nonces and should not be treated as such
    – bynicolas
    Aug 25, 2017 at 13:23
  • nonce is there to fight CSRF, if you use it for anything else then you are doing it wrong, but from this to claim that they should not be relied on.... at least the text can be read differently than what you might have intended to say Aug 25, 2017 at 13:28
  • at this point, someone that do not understand nonces might think from your answer that it is pointless to use them. Aug 25, 2017 at 13:31
  • I haven't said that they should not be relied on entirely. But you need to understand the way they work in order to use them properly. A nonce that was generated without a user id (logged in) will always return the same value for a period of 12 to 24 hours. So the expected behaviour from the op will never happen by using WP nonces. I will modify the answer to clarify the ambiguity.
    – bynicolas
    Aug 25, 2017 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.