Please refer to my comments on Greg's answer for more details in relation to his answer which are also relevant to this.
I'm routing all my AJAX requests through a
Controller, this is a class that simply localizes an endpoint and calls it further, as such, it's some sort of a router, it does some checks first:
Controller, on initialization, creates a nonce for the user in question. This nonce is global. Endpoints themselves don't have a nonce themselves and they are not registered as AJAX endpoints (as such, an attacker cannot simply bypass having to go through the
Controller, as such, a nonce check is only done once.
- Runs an access callback function such as
can_user( 'administrator' )every time it's called.
As such, my
Controller has two layers of security: one to check whether or not the request was made on behalf of the user who the
Controller gave that nonce to and another check to see if whoever is calling and endpoint has rights to (since all endpoints are open to everyone by default).
My intention here was to make the endpoints creation seamless and not have a lot of boilerplate if unnecessary and as such, I didn't want those who extend the system to have to create a nonce for each action but rather rely on an access callback to see if an action should happen.
My question is, given that
wp_create_nonce takes an argument of
$action, that is to say, it tries to contextualize a nonce to a specific action (which my
Controller isn't. The
Controller just simply calls an action and, supposedly, if that action wasn't called by same user, it bails), is this enough?
A side note.
I have tested the classic: access a link/complete a form to my website that would, in theory, do an action that an admin wouldn't want to, e.g. I tried to trick myself. The error given is, as expected "403: Forbidden" by means of the nonce being invalid.
My question is, then: why did the WP Core team have a need to try to bind a nonce to an action? Just for the sake of clarity?
If that is the case, it's definitely because the WP Core didn't write AJAX endpoints and the system to be put under a router-like-fancy-pants structure and so, they tried to single out endpoints with context so that they can be made sense of. In a system like mine, it's already made sense of by extension of me having a
Provider and helpful functionality to tell information about