I have implemented a plugin that allows an individual to search data that is available from the plugin and receive a list of results back from that search. Searching is the only act that can be performed. (There are admin settings, but, that doesn't factor into this particular case.) The plugin has been working well up until recently.

Here is how I'm building the form (shortened for this purpose).

$nonce = wp_nonce_field('my_search', 'my_search_nonce');
// some other code while I'm building the form
$search_html = <<<HTML
<form id="my-search-form" action="$post_url" method="post">
    <div class="form-field product-name">
        <label for="product-name">Product Name</label>
        <input name="product-name" type="text" id="product-name" class="form-control">
    <button type="submit">Search</button>

Recently, to speed up the website using this plugin, I enabled Redis cache as well as a CDN. During that time, the nonce began to not verify. It would fail on this code upon the submission of the form:

if ( ! isset( $_POST['my_search_nonce'] ) 
     || ! wp_verify_nonce( $_POST['my_search_nonce'], 'my_search' ) ) {

I do not have any other caching plugins on my site at this point.

I disabled the CDN and the issue did still happen when the Redis cache was active. I updated my settings so that the Redis cache times out after 11 hours (based on advice to be under 12 hours due to nonce timeouts). That seemed to fix it.

I then reenabled the CDN and, after a time, the issue returned. Oddly enough, though, when I view the network tab, the page itself (which holds the nonce) does not show an indication that it is returned from the CDN (AKA I don't see "Hit from [cdn]" in the response like I do for other items. And, if I clear the Redis cache, the form works again.

In my searching, someone had suggested to another individual that the nonce isn't needed at all for a simple search form that's offered on a public site. I don't know if that's good or bad advice. It also seems a bit like giving up on understanding and solving the actual problem.

I am at a bit of a loss now. It appears to be Redis. But the CDN seems to affect it. Insight into what I am not understanding would be appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.