Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [nonce]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
23 views

How to obtain "wp_rest" nonce for WP Statistics plugin manually?

During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed. To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-...
user avatar
  • 101
0 votes
0 answers
17 views

Log in user using Wordpress REST API

I am having problems authenticating a user after logging in using a custom endpoint using the WordPress REST API. I'm aware that this is not the perfect approach but I am just trying to make a few ...
user avatar
0 votes
1 answer
37 views

WordPress wp_localize_script nonce and ajax URL

I'm making an Ajax call in an Elementor site, and I'd like to use a nonce while doing it. Since my code is really simple, I didn't create a new JS file for it placed in Elementor's HTML widget, and I ...
user avatar
  • 3
0 votes
0 answers
32 views

How to verify which WordPress user requested the API in ASP .NET Core?

I have a use-case where I have a WordPress site and an ASP .NET Core as a Restful API backend. I use the WordPress site entire for Frontend, CMS, and User Authentication. On certain pages of my ...
user avatar
0 votes
0 answers
34 views

WP_List_Table Inside Metabox With Bulk Actions Not Working on Submit

I'm trying to display a WP_List_table inside a metabox. The metabox is for questions which are from assessment_question custom post type.The metabox is being displayed on an other custom post type '...
user avatar
0 votes
0 answers
28 views

Should wordpress nonce be placed in html form or in javascript file

This example is specifically related to woocommerce but apparently the same question also applies to wordpress. Hence I believe this question is relevant to this forum. Here goes the example: I create ...
user avatar
  • 101
0 votes
1 answer
37 views

WordPress "nonce" message

Random question but I can't work it out or find a solution. I need to find a way to change the WordPress "nonce" message. I'd like to replace to replace "nonce" with "error&...
user avatar
  • 103
0 votes
0 answers
610 views

Reliable way to add nonce to HTTP Header in WordPress?

I am trying to implement CSP on my wordpress site. Inspired by this question, https://stackoverflow.com/questions/50002041/adding-nonce-to-script-tag I tried to build a way to add nonces to my ...
user avatar
1 vote
0 answers
115 views

"The link you followed has expired" & "Error while saving" messages when adding new post

I'm currently unable to publish new posts on my wordpress site. Whenever I try, I get a "The link you followed has expired" error after clicking the "publish" button. Also, as I'm ...
user avatar
0 votes
0 answers
34 views

Validate nonce with post ID in AJAX

I'm trying to create a nonce in an AJAX form where I can pass in a post ID. Then, validate it of course. I want to confirm that if the action is intended, but also the post ID so someone cannot just ...
user avatar
  • 143
0 votes
1 answer
136 views

wp_verify_nonce return false despite correct parameter passed

I have created a form that have nonce <form action="<?php echo get_rest_url(null, 'ilms_plugin/new_membership') ?>" method="post" class=' space-y-2 mt-2 p-2 rounded-md '&...
user avatar
  • 17
0 votes
2 answers
963 views

Log out without confirmation request (nonce)

I have a Wordpress site with WooCommerce. I would like to add a Logout option to the Menu that logs out the user without asking for confirmation. So I included a menu custom link with as URL: /my-...
user avatar
  • 117
0 votes
1 answer
178 views

Extend Nonce Lifetime for Specific Nonce Creation

I've got as far as successfully filtering the global nonce_life but am running into trouble applying the filter in a specific function in the way described in this answer. function ...
user avatar
0 votes
1 answer
254 views

wp_nonce vs jwt

I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend. What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
user avatar
0 votes
1 answer
478 views

Why does check_ajax_referer give a 403 error on https websites?

When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended. But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
user avatar
1 vote
1 answer
123 views

Nonce failing on form submission

I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
user avatar
1 vote
1 answer
120 views

SSO autologin Wordpress + Ajax

That one keeps me awake at night. The problem is that the user is properly logging in, but AFTER page refresh and should be immediately logged in without page reload. Need a fresh eyes to look at it. ...
user avatar
1 vote
1 answer
55 views

how to send Ajax request in wordpress backend

On the fronted the wp_localize_script seems to be working as when I view the source I can see the nonce. wp_localize_script('scripts', 'myAjax', array( 'root_url' => get_site_url(), '...
user avatar
2 votes
0 answers
297 views

Nonces, AJAX, script variables & security in WordPress

Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using: wp_enqueue_script( 'script_handle', PATH_TO_SCRIPT, array(), '1.0.0', true ); ...
user avatar
  • 286
1 vote
1 answer
1k views

permission_callback has no effect

WP version is 5.5.3 I have 3 API routes set in a plugin that is used in an admin dashboard page. One route is meant to be used "publicly". I have two very curious issues happening: My 3 ...
user avatar
0 votes
1 answer
186 views

CSP nonces with Cloudflare Workers

Like this blog, I use Cloudflare Workers to inject CSP (Content Security Policy) nonce in headers : https://scotthelme.co.uk/csp-nonces-the-easy-way-with-cloudflare-workers/ This is functional. Next, ...
user avatar
1 vote
1 answer
458 views

Identical wp_rest nonce returned from rest_api

TLDR: How can I force a new nonce to be returned, so that AJAX works without refreshing the page? Following on from Nonces and Ajax request to REST API and verification I implemented the Nonce ...
user avatar
  • 137
2 votes
1 answer
840 views

Nonces and Ajax request to REST API and verification

Building my first WordPress in over a decade... using Timber for MVC. Vue on the frontend, and axios for ajax posts. All hosted on the same domain, so I can use cookies for authentication. I am ...
user avatar
  • 137
0 votes
1 answer
2k views

Using a nonce Content Security Policy header for style-src for inline style elements returns errors

When using a nonce in a Content Security Policy header, both Google Chrome and Firefox return errors. The nonce value is for a style element i.e. <style id="some-id">// CSS </style&...
user avatar
  • 11
1 vote
1 answer
792 views

Found 2 elements with non-unique id (#_ajax_nonce) and (#_wpnonce)

I am developing custom theme from scratch and creates a custom post type and getting this warning while editing custom post type. I also design custom Meta box with two input fields and using nonce in ...
user avatar
0 votes
1 answer
116 views

Wordpress JSON API nonces and Vue development server

As stated in the official docs, the JSON API CSRF protection only works from within Wordpress. It is important to keep in mind that this authentication method relies on WordPress cookies. As a result ...
user avatar
  • 511
0 votes
1 answer
728 views

WordPress is creating nonce as a logged in user but verifying it incorrectly

I'm having trouble validating a nonce created with wp_create_nonce() inside a hidden input with the name nonce in an html form: <input type="hidden" name="nonce" value="<...
user avatar
  • 162
0 votes
1 answer
216 views

Change button link to add nonce

I am making a Logout button, but in order for it to work properly the link needs to have the correct nonce ("site.com/wp-login.php?action=logout&wp_nonce=X". I have found in another ...
user avatar
0 votes
1 answer
137 views

Verify a nonce in Form submission

I am new in using Nonce.I am using Nonce like below in a Form wp_nonce_field('add_new_addres','add_new_address'); I am trying to verify Nonce like below if(isset( $_REQUEST['action'] ) &&...
user avatar
  • 170
0 votes
0 answers
176 views

wp_verify_nonce not working on the mobile device

I am using a very simple form request to and verify it through the wp_verify_nonce() function. It is working perfectly on the desktop. But not working on mobile devices( iPhone, Andriod ). Could ...
user avatar
  • 267
0 votes
1 answer
1k views

How to not cache nonces with WP Rocket?

We have a system where we pass a nonce from a PHP-script on the server to an AJAX-call running client-side, and then back again to check the validity of the request. This nonce is cached, and we can'...
user avatar
  • 42
0 votes
0 answers
32 views

How do I mitigate replay attacks when talking about actions that shouldn't happen twice?

A nonce is supposed to first help me against CSRF and help against replay attacks is just a bonus if I "personalize" the nonce to something like pay-user-{id}, but here's the problem - if my link ...
user avatar
1 vote
0 answers
312 views

Draft preview and customize permission problems on multisite main site

So I've been stuck on this problem for quite a while now and it feels like I've tried everything. I would love for some support here. Setup A WordPress multisite with Bedrock structure PHP 7.3.17 (...
user avatar
  • 11
2 votes
1 answer
2k views

Can't GET draft posts via REST API from headless frontend

I have a headless install of Wordpress on v5.4.0. The frontend can't GET any post that is in draft status, though when accessing the API url directly the data is returned without an issue. I'm ...
user avatar
2 votes
1 answer
2k views

Properly applying nonce to a form using AJAX

So I'm still learning around WordPress and can't seem to figure out how to properly hook a nonce into a AJAX Form that I have created. Here I am hooking and localizing the js file and defining a ...
user avatar
  • 177
0 votes
1 answer
177 views

Why are nonces working in Firefox but not in Chrome?

I created the nonce when I localize a script file: wp_localize_script('cad-search', 'cad_ajax', array( 'ajaxurl' => admin_url( 'admin-ajax.php' ), 'nonce'=> wp_create_nonce('...
user avatar
  • 661
0 votes
1 answer
230 views

Backbone with custom rest endpoints

I have created a custom endpoint that returns select user meta data. I am trying to access this endpoint with Backbone. It works as expected in Postman and from my Backbone/javascript script If I have ...
user avatar
  • 51
0 votes
1 answer
245 views

Is it safe to use a global wp nonce per user instead of a nonce per action?

Please refer to my comments on Greg's answer for more details in relation to his answer which are also relevant to this. I'm routing all my AJAX requests through a Controller, this is a class that ...
user avatar
1 vote
0 answers
292 views

x-wp-nonce across domains

I've installed WPML with a multiple domain configuration (one domain per language). The wrong thing is that, when editing for example a post while using a different domain from the main, it just ...
user avatar
0 votes
0 answers
60 views

whether a nonce is required for get type and get_query_var?

I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not. I use the get_query_var method to modify the main query. It uses a get method. whether a nonce is ...
user avatar
0 votes
0 answers
43 views

Unable to update plugins or log out

The server my site was hosted on recently went down and someone else was able to fix it for me. I am unclear on what exactly the issues with the server were, but since the site came back up, my cron ...
user avatar
  • 315
1 vote
0 answers
49 views

Is nonce in PHP form and Ajax both necessary?

I have a php form which is submitted through jQuery Ajax. Previously i had used nonce with Ajax and PHP form seperately. Here i am using wp_nonce_field() in PHP form. Is it necessary to use ...
user avatar
  • 57
2 votes
1 answer
230 views

When is it useful to use wp_verify_nonce

I know that wp_verify_nonce() is used to make sure that the $_POST is coming from a safe place. I am developing a WordPress plugin which creates custom lists. In order to do that the web site owner ...
user avatar
2 votes
1 answer
2k views

Headless Wordpress: How to authenticate front end requests?

I am envisioning Wordpress on the back end to work with React.js on the front end like this: Wordpress is installed on http://example.com/api React.js script is loaded into http://example.com/index....
user avatar
  • 347
1 vote
1 answer
1k views

Passing a borrowed nonce through Postman fails

I'm trying to test borrowing a nonce from my browser session so that I can use it elsewhere, namely in my npm dev environment. I took a nonce passed into an open Chrome browser session, put it in a ...
user avatar
  • 347
1 vote
1 answer
436 views

WP nonce invalid

Have a quick script to search for untranslated pages, and then returning a translate link. (Polylang makes a new post for a translation, which is then linked to the original.) All is working well, ...
user avatar
0 votes
1 answer
1k views

Rest API: wp_verify_nonce() fails despite receiving correct nonce value

I am generating a nonce to be used with client side fetch requests to the rest api: function prepAllAdminScripts() { wp_register_script( 'reactAdminArea' , PLUGIN_FOLDER_URL . 'shared/...
user avatar
  • 347
0 votes
0 answers
50 views

Does it make sense to check a nonce on user log in?

I read the following blog post about implementing custom user log in: http://natko.com/wordpress-ajax-login-without-a-plugin-the-right-way/ In the post, the author walks through some PHP code for ...
user avatar
1 vote
1 answer
411 views

wp_create_nonce doesn't verify when using WP_List_Table

I've created an admin page where I'm displaying a list of a MySQL Table using WP_List_Table. In this table I need to be able to delete a record when I want to. And that's where I have a problem. To ...
user avatar
  • 66
0 votes
1 answer
98 views

Custom Meta Boxes - Nonce Issue - Move to trash issue

Recently after updating Wordpress from 4.9.2 to 5.2, I have had to change a good bit of code to get my custom post type listings(or posts) to function and save data correctly. Specifically, with the ...
user avatar
  • 11

1
2 3 4 5