WordPress Development

Questions tagged [nonce]

Ask Question

The tag has no usage guidance.

190 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
1answer
19 views

WordPress is creating nonce as a logged in user but verifying it incorrectly

I'm having trouble validating a nonce created with wp_create_nonce() inside a hidden input with the name nonce in an html form: <input type="hidden" name="nonce" value="<...
0
votes
0answers
17 views

WordPress nonces are wrong and not working?

I really don't understand what is happening with WordPress nonces, i think they're wrong, or they're useless. I always have troubles working with that nonces, WordPess never been able to check one ...
0
votes
1answer
14 views

Change button link to add nonce

I am making a Logout button, but in order for it to work properly the link needs to have the correct nonce ("site.com/wp-login.php?action=logout&wp_nonce=X". I have found in another ...
0
votes
1answer
51 views

Verify a nonce in Form submission

I am new in using Nonce.I am using Nonce like below in a Form wp_nonce_field('add_new_addres','add_new_address'); I am trying to verify Nonce like below if(isset( $_REQUEST['action'] ) &&...
0
votes
0answers
74 views

wp_verify_nonce not working on the mobile device

I am using a very simple form request to and verify it through the wp_verify_nonce() function. It is working perfectly on the desktop. But not working on mobile devices( iPhone, Andriod ). Could ...
0
votes
0answers
30 views

How to use wp_create_nonce() to get user ID in WordPress Rest Api

I know a lot of questions have been asked about this topic but I have had no luck implementing their code. I want to be able to use get_current_user_id() inside my WordPress Rest Api. This is what I ...
0
votes
1answer
89 views

How to not cache nonces with WP Rocket?

We have a system where we pass a nonce from a PHP-script on the server to an AJAX-call running client-side, and then back again to check the validity of the request. This nonce is cached, and we can'...
0
votes
0answers
20 views

How do I mitigate replay attacks when talking about actions that shouldn't happen twice?

A nonce is supposed to first help me against CSRF and help against replay attacks is just a bonus if I "personalize" the nonce to something like pay-user-{id}, but here's the problem - if my link ...
1
vote
0answers
44 views

Draft preview and customize permission problems on multisite main site

So I've been stuck on this problem for quite a while now and it feels like I've tried everything. I would love for some support here. Setup A WordPress multisite with Bedrock structure PHP 7.3.17 (...
0
votes
0answers
12 views

Persist nonce across user sessions?

As per the WordPress Codex nonces are unique to the current user's session, so if a user logs in or out asynchronously any nonces on the page will no longer be valid. I am using a nonce to secure ...
0
votes
0answers
10 views

How to submit multiple nonces at once?

I have a form that incorporates three different forms from a plugin. Usually, each form would have it's own submit + nonce (which already exist and work), but I need to have just a single submit ...
0
votes
0answers
13 views

Not able to show entered value for a text input in a meta box

So I've searched for weeks and I know there are a lot of questions about this topic but I cannot figure out how to show the value that a user inputs into a text field in a custom meta box. I get the ...
2
votes
1answer
379 views

Can't GET draft posts via REST API from headless frontend

I have a headless install of Wordpress on v5.4.0. The frontend can't GET any post that is in draft status, though when accessing the API url directly the data is returned without an issue. I'm ...
1
vote
1answer
98 views

Properly applying nonce to a form using AJAX

So I'm still learning around WordPress and can't seem to figure out how to properly hook a nonce into a AJAX Form that I have created. Here I am hooking and localizing the js file and defining a ...
0
votes
0answers
14 views

Respond to wpnonce on front end

I've been doing some work recently with custom bulk actions and post row actions which hook into the admin_notices action to perform some function in the admin and return a notice with the result. ...
0
votes
0answers
20 views

Trying to wrap my head around the REST API, authentication, access tokens, and connecting an external app

Background and motivation I have been building an art education site for my mom for about a year and it's been a great learning experience / place to experiment. I use s2members to control access to ...
0
votes
0answers
17 views

What is the benefit of logout using an nonce?

I get the purpose of nonce in general, but It seems like this particular action would be safe without an nonce. What benefit does it bring?
0
votes
1answer
40 views

Why are nonces working in Firefox but not in Chrome?

I created the nonce when I localize a script file: wp_localize_script('cad-search', 'cad_ajax', array( 'ajaxurl' => admin_url( 'admin-ajax.php' ), 'nonce'=> wp_create_nonce('...
0
votes
1answer
65 views

Backbone with custom rest endpoints

I have created a custom endpoint that returns select user meta data. I am trying to access this endpoint with Backbone. It works as expected in Postman and from my Backbone/javascript script If I have ...
0
votes
1answer
72 views

Is it safe to use a global wp nonce per user instead of a nonce per action?

Please refer to my comments on Greg's answer for more details in relation to his answer which are also relevant to this. I'm routing all my AJAX requests through a Controller, this is a class that ...
0
votes
0answers
73 views

Problem with ajax login/logout and nonces

My current flow is as follows: I use wp_localize_script to generate a nonce which my javascript can use. I pass this nonce with my login and logout request. When I login I touch the dom by removing ...
1
vote
0answers
171 views

x-wp-nonce across domains

I've installed WPML with a multiple domain configuration (one domain per language). The wrong thing is that, when editing for example a post while using a different domain from the main, it just ...
0
votes
0answers
31 views

Is a global nonce a bad idea?

I'm trying to build a central system that will delegate certain functionality and serve me some nice things when dealing with AJAX calls. Basically, I want to dumb the whole charade of checking ...
0
votes
0answers
74 views

Nonce timing out when cache is in use

I have implemented a plugin that allows an individual to search data that is available from the plugin and receive a list of results back from that search. Searching is the only act that can be ...
0
votes
0answers
25 views

whether a nonce is required for get type and get_query_var?

I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not. I use the get_query_var method to modify the main query. It uses a get method. whether a nonce is ...
0
votes
0answers
29 views

Unable to update plugins or log out

The server my site was hosted on recently went down and someone else was able to fix it for me. I am unclear on what exactly the issues with the server were, but since the site came back up, my cron ...
1
vote
0answers
37 views

Is nonce in PHP form and Ajax both necessary?

I have a php form which is submitted through jQuery Ajax. Previously i had used nonce with Ajax and PHP form seperately. Here i am using wp_nonce_field() in PHP form. Is it necessary to use ...
2
votes
1answer
50 views

When is it useful to use wp_verify_nonce

I know that wp_verify_nonce() is used to make sure that the $_POST is coming from a safe place. I am developing a WordPress plugin which creates custom lists. In order to do that the web site owner ...
2
votes
1answer
706 views

Headless Wordpress: How to authenticate front end requests?

I am envisioning Wordpress on the back end to work with React.js on the front end like this: Wordpress is installed on http://example.com/api React.js script is loaded into http://example.com/index....
1
vote
1answer
374 views

Passing a borrowed nonce through Postman fails

I'm trying to test borrowing a nonce from my browser session so that I can use it elsewhere, namely in my npm dev environment. I took a nonce passed into an open Chrome browser session, put it in a ...
1
vote
1answer
199 views

WP nonce invalid

Have a quick script to search for untranslated pages, and then returning a translate link. (Polylang makes a new post for a translation, which is then linked to the original.) All is working well, ...
0
votes
1answer
319 views

Rest API: wp_verify_nonce() fails despite receiving correct nonce value

I am generating a nonce to be used with client side fetch requests to the rest api: function prepAllAdminScripts() { wp_register_script( 'reactAdminArea' , PLUGIN_FOLDER_URL . 'shared/...
0
votes
0answers
28 views

Does it make sense to check a nonce on user log in?

I read the following blog post about implementing custom user log in: http://natko.com/wordpress-ajax-login-without-a-plugin-the-right-way/ In the post, the author walks through some PHP code for ...
1
vote
0answers
185 views

wp_create_nonce doesn't verify when using WP_List_Table

I've created an admin page where I'm displaying a list of a MySQL Table using WP_List_Table. In this table I need to be able to delete a record when I want to. And that's where I have a problem. To ...
0
votes
1answer
45 views

Custom Meta Boxes - Nonce Issue - Move to trash issue

Recently after updating Wordpress from 4.9.2 to 5.2, I have had to change a good bit of code to get my custom post type listings(or posts) to function and save data correctly. Specifically, with the ...
3
votes
2answers
341 views

Nonce in settings API with tabbed navigation

I'm rewording this because, as it's correctly been pointed out, the original post was "woefully inadequate." I made a plugin which has tabbed views for the various settings. It's based on this ...
1
vote
1answer
834 views

Wordpress REST API, Expired Nonce from Cache results in 403 forbidden

My wordpress site sits behind Akamai, which is a cacheing service similar to Cloudflare. I make the following API call: GET /wp-json/mytheme/v1/get-posts?post_type=videos This is done using ...
0
votes
0answers
30 views

wp_verfy_nonce keeps giving false

i have a form somthing like this <form id="sample_docs" method="post" action="<?php echo admin_url('admin-ajax.php'); ?>"> <?php wp_nonce_field('nonce_action_sample_docs', '...
1
vote
1answer
32 views

Can a wp_nonce created from domain 1 to be verified on domain 2?

From the Domain 1 i want to make an AJAX request to Domain 2. I would like to create a wp_nonce on Domain 1 and send it with AJAX request to Domain 2, then verify it on Domain 2. The 2 domains are ...
0
votes
0answers
22 views

Nonce - reissue with ajax poll

I have a plugin which displays a map with markers. Using SetInterval I am refreshing the markers at a pre-determined interval using an ajax call. It is only reading data, no updates. I am using a ...
2
votes
1answer
700 views

Handling nonces for actions from guests to logged-in users

Imagine the following scenario: John has an account on my website, but is currently not logged in. He clicks the "upvote" button on an article, but is redirected to the login page because only logged-...
1
vote
0answers
19 views

Why ajax doesn't work on certain wordpress hooks and reload the page instead?

I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
0answers
35 views

Why ajax doesn't work on certain wordpress hooks?

I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
1answer
485 views

“The link you followed has expired” when previewing a post

Recently, I believe after switching to WP 5, non admin users are randomly getting the following error when previewing a post: “The link you followed has expired” . Please try again I am suspecting ...
0
votes
2answers
454 views

Serving nonces through AJAX is not refreshing nonce, returning 403 error

I have run into an issue with nonces becoming invalid, and being unable to refresh to a new nonce. In my example I have a Facebook Connect button, and a Facebook Disconnect button, each with their own ...
0
votes
1answer
128 views

How to check nonce lifetime value of plugins?

Dear StackExchange users, I currently use the premium version of WP Fastest Cache Premium. My website loads very fast, but I always get a 403 error for wp-admin/ajax. I believe there is a plugin ...
0
votes
0answers
196 views

wp_nonce_url generating invalid links

My goal is to allow users to delete posts they own from the front end. I have an API that returns some JSON along with a link to delete their post. $delLink = wp_nonce_url( site_url() . "/wp-admin/...
3
votes
2answers
4k views

Verify nonce in REST API?

I would like to understand the best practices regarding nonce validation in REST APIs. I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
4
votes
0answers
563 views

WordPress REST API call generates nonce twice on every call

I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
0
votes
1answer
53 views

Re-use Nonce in Repeating Event Signup Buttons

My understanding is that wordpress nonces (not exactly a "number used once") prevent cross-origin request forgery and last 12 hours. I'm displaying a schedule of classes with a registration button ...

1
2 3 4