1

I believe there are multiple ways to use nonce.

Recently I've used wp_nonce_field('any_nonce_value');

which creates a <input type="hidden" id="_wpnonce" name="_wpnonce" value="111bc61eba">

and it could be confirmed using check_admin_referer('any_nonce_value');

Another way would be to use <input type="hidden" name="_wp_nonce_or_anything_we_desire" value="<?php echo wp_create_nonce('any_nonce_value'); ?>">

We can check this using wp_nonce_verify($_POST['_wp_nonce_or_anything_we_desire'], 'any_nonce_value')

Is my understanding about nonce correct? So here's the confusion

When trying to create a custom metabox, adding custom columns, managing custom columns and finally saving the post. Where do we need to pass the nonce. To make my question clearer.

When we hook in to save_post, following partial code is suggested at https://codex.wordpress.org/Plugin_API/Action_Reference/quick_edit_custom_box

 $_POST += array("{$slug}_edit_nonce" => '');
    if ( !wp_verify_nonce( $_POST["{$slug}_edit_nonce"],
                           plugin_basename( __FILE__ ) ) )
    {
        return;
    }

So should we be creating a custom nonce? while creating metabox? Or should we just use the custom post type slug here and rest is managed by Wordpress? Looking forward to your helpful answer, that will hopefully help many others like me! Thanks.

  • 1
    We have a 1 question per question policy, asking multiple questions in a single question significantly reduces the chances of an answer – Tom J Nowell Sep 25 '18 at 12:59
  • Oh okay, thank you for reminding me. While I am still relatively new to the Stack, I think i was so involved in the problems since a few hours that I completely overlook it. Thanks! – Adnan Sep 25 '18 at 13:00
  • As an aside, a good example of why you shouldn't, is that I can write a very good answer for your first question, but for the second question shrugs, no idea. The majority of people in that situation will skip the question. The same is true of the reverse. Also, it's not possible for you to mark an answer as correct unless it answers both questions, making the chances of an answer even smaller, and depriving you of rep for bounties, ads removal perk, etc. I'd recommend editing it and removing the second question, and asking that separately. You can always link to this question for context – Tom J Nowell Sep 25 '18 at 13:07
  • Agreed. I'll just do that. Thanks Tom. Edit: Post is now edited. – Adnan Sep 25 '18 at 13:13
1

When trying to create a custom metabox, adding custom columns, managing custom columns and finally saving the post. Where do we need to pass the nonce. To make my question clearer.

This is not correct, you shouldn't need a nonce in a metabox because all that information is sent at once in the full request when updating or publishing, and WP already handles that for you.

I think the confusion here is that it was never explained what a nonce is supposed to protect against, and why it's used.


In the days of myspace, you could put an image tag in your profile, and set src="http://myspace.com/logout", and everybody who visited your profile would get logged out.

A nonce on the other hand, is a time sensitive value, that protects against this by ensuring that you clicked the button, or did the thing because you actually clicked the thing, and not because of an CSRF attack.

So if you're doing something that does something, then yes use a nonce. If you're just reading values, then no, there's no need. More than one nonce doesn't add protection either, hence metaboxes

Also, check_admin_referer and wp_nonce_verify are not the same:

  • wp_nonce_verify literally just checks the nonce
  • check_admin_referer calls wp_nonce_verify internally, but it also does things based on the result, and will exit/abort if it fails, and it also checks the referer values
  • wp_nonce_verify only checks the nonce and returns true/false, it's up to you to do something with that value

the same with wp_create_nonce and wp_nonce_field

  • wp_create_nonce creates a nonce value. It's up to you to do something with it
  • wp_nonce_field outputs an entire hidden field, and calls wp_create_nonce internally, and does some other stuff

Think of them as the difference between buy_brick() and build wall()

  • Great, this clarifies my confusion about nonce itself. but the nonce implementation needs to be understood maybe in a separate question and another about saving data from a custom column input/checkbox to post meta. I'll try to draft better questions next time :) – Adnan Sep 25 '18 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.