6

I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It could be used 9999 times during this period (by same client).

I thought that a WordPress nonce is really a number used once and that a nonce is valid only for one-time usage, but that's not the case. I guess for a better security, a one-time usage number would be better, e.g. you have a commenting system and someone clicks on "reply" two times. Instead of inserting the comment two times, it is being inserted one time, because of the one-time valid nonce (same one) given in the two requests.

Am I getting something wrong? What is the purpose of those WordPress nonces?

Improve this question
2

2 Answers 2

Reset to default
6

If you read Wordpress Nonces in Codex, they have explained it pretty fairly. some of the key points are:

  1. always assume Nonces can be compromised.
  2. Nonces are a hash made up of numbers and letters.
  3. Wordpress Verifies any https request with both nonces and user cookies.

I believe point #3 is, in short, is how it works with WordPress. They have mentioned that use current_user_can() function instead of wordpress nonces.

As for the purpose, I believe, it serves basic purpose of multilayer security. Read this Are Nonces Useless

Improve this answer
2
  • 3
    "always assume Nonces can be compromised" is written in this explanation in the context of using it for authentication. but for protecting from CSRF it's a good solution
    – mmm
    Mar 21, 2018 at 14:14
  • The codex mentions this, but TL;DR it's important to note that they are not limited to a single use. A nonce can be used any number of times within its allowed "lifetime".
    – Evan Mattson
    Mar 27, 2018 at 18:12
4

As you spotted correctly, wordpress do not use literal NONCEs, but a good enough approximation.

The implementation problem with the literal definition of nonce, is that you need to track all the numbers you have generate, especially if they are truly random. This mean to store in the DB the generated nonce, which means that there will be a DB write on every admin page refresh, which might strain the server.

Wordpress compromise is to generate the nonce as a hashed value of the current day, using a secret hash key and a user sensitive context. This way the window of a possible attack is limited to 24 hours, and it is hard to guess the nonces. There is still a problem of interception if your site is on HTTP, and you do any admin while on public WiFi networks, but in that case your whole authentication is exposed and nonce exposure is the least of your problems.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.