0

When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended. But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why it doesn't work.

What am I missing? Any ideas?

Form (widget class):

public function widget( $args, $instance ){
    $action = '?action=registration';
    $unique_string = "Unique string";
    $nonce = wp_create_nonce($unique_string);
        
    wp_localize_script('registration_script', 'registration_ajax_object',
        array(
            'ajaxurl' => admin_url('admin-ajax.php') . $action,
            'nonce' => $nonce
        )
    );
    ?>
    ...form...
    <?php
}

Main plugin file:

function ajax_registration(){
    check_ajax_referer('Unique string', 'nonce');
    ...
}
add_action('wp_ajax_registration', 'ajax_registration');
add_action('wp_ajax_nopriv_registration', 'ajax_registration');

JS file:

let ajaxurl = registration_ajax_object.ajaxurl;
let nonce = registration_ajax_object.nonce;
$.ajax({
    type: 'post',
    url: ajaxurl,
    data: {
        'nonce': nonce,
        ...
    }, ...
});

1 Answer 1

1

that looks good in my eyes. but i just had the same issue, that's why i stumbled over your question.

i fixed it in my case with

if (!wp_verify_nonce($_POST['nonce'], 'nonce')) {
    die(__('Security Check failed', 'textdomain'));
}

at the very beginning of my ajax action. no idea, where the 403 issue came from, since it worked on desktop machines, but not on my mobile. weird.. give it a shot and let me know, if this helps.

one other thing i saw in your code, but not sure, if it is causing issues: one time you use single quotes, the other time doubles. try to be consistent here.

wp_verify_nonce()

4
  • Thank you for your help. I've arrived at the same conclusion. On https sites you have to use wp_verify_nonce() and NOT check_ajax_referer(). You can do it as a one-liner: wp_verify_nonce($_POST['nonce'], 'Unique string'); Illogical, but that's how it is. I did not see any difference between desktop and mobile though. Quotes are consistent in my files, it's just an oversight while using the stackoverflow editor. Edit: But we still don't know why it works like this. Commented Feb 9, 2021 at 12:25
  • 1
    i just figured out, that caching also might be an issue! when you use some kind of template caching, you most certainly also cache your nonces. at least this explains my issue with desktop/mobile. so i now told my caching tool to recreate cache every 8hours. was 10, but i had issues with that setting.
    – honk31
    Commented Feb 9, 2021 at 14:25
  • Yeah, I can see why caching may cause inconsistencies. I always test without it though. What tool do you use for it? Does it make a good difference in loading times? Commented Feb 9, 2021 at 18:16
  • 1
    i always used w3tc, it is good. but i had issues with minify. so i switched to wp rocket. not super happy with it..
    – honk31
    Commented Feb 10, 2021 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.