increase nonce lifespan

Question

I want to increase the nonce lifespan from the default 12-24h, to 36-48h.

I found the following code in the codex, but don't know where to put it.

add_filter( 'nonce_life', function () { return 172800; } );

can i put this line in the functions.php to change the nonce lifespan sitewide?

Is there an easy way to check the sitewide default lifespan of nonces?

Are there any security issues with increasing the nonce lifetime by 24h?

Are you expecting people to have your page open for 48hrs and still want to submit? — Jacob Peattie, Jan 23, 2018 at 9:03
I am using a caching plugin that delivers pages that are up to 24h old. In some cases the nonce is not valid anymore, and some functions on the page, like a rating don't work. — Philip, Jan 23, 2018 at 9:19

Mark Kaplun · Accepted Answer · 2018-01-23 08:22:16Z

3

Yes
Not really, but you can verify your change by login to admin and go to your profile. Wait 18 hours and try to submit. It should fail.
The longer the nonce expiration time is the longer an attacker might be able to trick you into performing unintended operation (but there is actually very slim chance for that unless you have an http site and like to use it in public wifi/networks, but then nonce is not your biggest problem).

answered Jan 23, 2018 at 8:22

Mark Kaplun

23.2k7 gold badges40 silver badges63 bronze badges

Add a comment |

1 Answer 1