Skip to main content

Questions tagged [nonce]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
26 views

Do I need to validate the nonce when using the settings api?

I have been developing a plugin. When using the 'Plugin Check' Wordpress plugin to check it before submission, it gave me a warning that 'Processing form data without nonce verification.' Do I need to ...
dading84's user avatar
  • 101
0 votes
1 answer
59 views

How to add a nonce check correctly to this specific code?

Here's what I have so far: add_action( 'wp_ajax_test_process', 'test_process' ); function test_process( $data ) { if ( !is_user_logged_in() ) { return; } if ( !current_user_can( '...
WPdummy's user avatar
  • 23
0 votes
1 answer
61 views

Nonce validation in REST API

I am creating a headless Wordpress website. Wordpress backend (port 8888), VueJS frontend (port 8081). Data is loaded via REST API. This works fine. Now I want to implement the preview-functionality. ...
klaaskox's user avatar
  • 111
1 vote
0 answers
22 views

nonce_user_logged_out to assign guests unique nonces breaks ajax calls

I've been researching implementing unique guest nonces via nonce_user_logged_out - for reference. So far I can generate nonces for the random UID I create: add_filter( 'nonce_user_logged_out', '...
ghosted's user avatar
  • 11
1 vote
0 answers
50 views

Nonce verification problem when logging in after a logout

I'm having a problem with nonce verification. The theme I'm using has an AJAX login form that has nonce as a hidden field. It normally goes to my account page after a logout, and I can re-login from ...
FlyingFish's user avatar
1 vote
1 answer
48 views

Check nonce in the new bulk_edit_posts action

In a plugin I'm developing, I need to add the ability to bulk edit some meta fields in a custom post named "lot". I want to use the new bulk_edit_posts hook added in WP 6.3. This is the code ...
leemon's user avatar
  • 1,958
0 votes
0 answers
30 views

How to stop a nonce from being cached in an inline script, or alternatives to regenerate it if expired?

I have an inline script that gets added into some WordPress pages which fires an AJAX request. We pass a nonce in that script, when using full page caching that nonce might have expired and therefore ...
bigdaveygeorge's user avatar
0 votes
1 answer
60 views

Is Nonce Verification (CSRF) required for WordPress Custom Bulk User Actions?

In short, this is a question about whether or not nonce verification is required for custom bulk user actions? Their guidance (albeit old) on how to implement custom bulk actions does not include or ...
anderly's user avatar
  • 468
0 votes
0 answers
37 views

Accessing an auth protected custom WP API enpoint from remote origin

I'm creating a Chrome browser extension that connects to a WordPress through its custom REST API endpoints. Retrieving data types that don't require an authorized user to be logged in works fine, as ...
Vitor Rodrigues's user avatar
1 vote
0 answers
43 views

wp_localize_script being cached

I've faced a problem of nonce value is being cached. I've embed the nonce in html by using wp_localize_script() However, the cache plugin has cached this value. Which result in nonce invalid from time ...
PokxE's user avatar
  • 11
0 votes
0 answers
200 views

How do i set up ajax nonce

Follow the doc, I tried to set up X-WP-NONCE before ajax sent data to custom route, but it show wpApiSettings.nonce not defined. If don't set beforeSend, on the back end still can pass the nonce ...
Basco's user avatar
  • 1
0 votes
0 answers
60 views

WooCommerce Order Sync via Custom REST API Endpoint Failing

I have a WooCommerce website with a specialized plugin that syncs orders to a delivery company. This plugin adds a button next to each order in the orders table, which, when clicked, triggers a sync. ...
TheSwiss's user avatar
0 votes
1 answer
54 views

Saving metabox updates causing fatal error

I'm teaching myself from a plugin tutorial dvd, everything was going fine. I've setup custom_post_types and the metaboxes with no issues. The issue i have is a fatal error when i update/publish the ...
fuzzy2023's user avatar
0 votes
1 answer
294 views

Rest API nonce is being cached

I'm building a custom Rest Api endpoint. User can call this endpoint via ajax request in the frontend together with nonce value which was created by wp_localize_script( 'some-js', 'wpApiSettings', [ ...
PokxE's user avatar
  • 11
1 vote
1 answer
762 views

Logout button in menu without "wp" in links

Update: This question was initially about how to log a user out without confirmation, but from a "pretty" URL without a logout nonce. However, in retrospect I realize this is a security ...
G.S.'s user avatar
  • 15
0 votes
1 answer
119 views

Wp doesn't save meta box data

My WP doesn't save my meta box data. I see the metabox and the field, but the data doesn't saving. Somebody could help me? Thank you. This is the code: // 1. Metabox létrehozása function my_meta_box(){...
Eszter's user avatar
  • 1
0 votes
0 answers
149 views

Weird nonce validation problem

I have a front-end form (ie, should work for non-logged-in users) with a nonce - "my-nonce-name". The problem is that it sometimes verifies upon submission and sometimes not, for - to me - ...
yms's user avatar
  • 35
0 votes
1 answer
323 views

Where to use nonce

I am learning WordPress Plugin Development. My Code is like below. class Admin { public function __construct() { add_action( 'admin_menu', [$this,'news_meta_boxes'] ); ...
Foysal's user avatar
  • 449
1 vote
1 answer
42 views

How to use nonce

I am learning Plugin development. I have several MetaBox call back functions. In this regard where should I use wp_nonce_field() ?
abu abu's user avatar
  • 203
0 votes
1 answer
62 views

How to use the wpsnonce clone post link?

I have this link from a CPT, to clone a post, in this case post=30808: https://domain.com/wp-admin/admin.php?action=duplicate_post_clone&post=30808&_wpnonce=240f0078e7 Now, I need to use this ...
Horacsio's user avatar
1 vote
1 answer
36 views

Restrict Access without Creating Users

I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill ...
Kevin Nugent's user avatar
0 votes
1 answer
154 views

How to obtain "wp_rest" nonce for WP Statistics plugin manually?

During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed. To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-...
skavans's user avatar
  • 101
2 votes
0 answers
607 views

Log in user using Wordpress REST API

I am having problems authenticating a user after logging in using a custom endpoint using the WordPress REST API. I'm aware that this is not the perfect approach but I am just trying to make a few ...
Courtney's user avatar
  • 163
1 vote
1 answer
604 views

WordPress wp_localize_script nonce and ajax URL

I'm making an Ajax call in an Elementor site, and I'd like to use a nonce while doing it. Since my code is really simple, I didn't create a new JS file for it placed in Elementor's HTML widget, and I ...
yaara's user avatar
  • 13
0 votes
0 answers
74 views

How to verify which WordPress user requested the API in ASP .NET Core?

I have a use-case where I have a WordPress site and an ASP .NET Core as a Restful API backend. I use the WordPress site entire for Frontend, CMS, and User Authentication. On certain pages of my ...
user2672399's user avatar
0 votes
0 answers
171 views

WP_List_Table Inside Metabox With Bulk Actions Not Working on Submit

I'm trying to display a WP_List_table inside a metabox. The metabox is for questions which are from assessment_question custom post type.The metabox is being displayed on an other custom post type '...
Muhammad Faizan Haidar's user avatar
0 votes
1 answer
104 views

WordPress "nonce" message

Random question but I can't work it out or find a solution. I need to find a way to change the WordPress "nonce" message. I'd like to replace to replace "nonce" with "error&...
Paul's user avatar
  • 103
0 votes
1 answer
2k views

Reliable way to add nonce to HTTP Header in WordPress?

I am trying to implement CSP on my wordpress site. Inspired by this question, https://stackoverflow.com/questions/50002041/adding-nonce-to-script-tag I tried to build a way to add nonces to my ...
Aditya Agarwal's user avatar
1 vote
0 answers
412 views

"The link you followed has expired" & "Error while saving" messages when adding new post

I'm currently unable to publish new posts on my wordpress site. Whenever I try, I get a "The link you followed has expired" error after clicking the "publish" button. Also, as I'm ...
Harrison's user avatar
0 votes
1 answer
1k views

wp_verify_nonce return false despite correct parameter passed

I have created a form that have nonce <form action="<?php echo get_rest_url(null, 'ilms_plugin/new_membership') ?>" method="post" class=' space-y-2 mt-2 p-2 rounded-md '&...
murni's user avatar
  • 37
0 votes
2 answers
4k views

Log out without confirmation request (nonce)

I have a Wordpress site with WooCommerce. I would like to add a Logout option to the Menu that logs out the user without asking for confirmation. So I included a menu custom link with as URL: /my-...
Nick's user avatar
  • 127
0 votes
1 answer
531 views

Extend Nonce Lifetime for Specific Nonce Creation

I've got as far as successfully filtering the global nonce_life but am running into trouble applying the filter in a specific function in the way described in this answer. function ...
Kevin Nugent's user avatar
0 votes
1 answer
643 views

wp_nonce vs jwt

I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend. What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
user avatar
0 votes
1 answer
1k views

Why does check_ajax_referer give a 403 error on https websites?

When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended. But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
Vörös Imi's user avatar
1 vote
1 answer
313 views

Nonce failing on form submission

I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
Chris J. Zähller's user avatar
2 votes
1 answer
235 views

SSO autologin Wordpress + Ajax

That one keeps me awake at night. The problem is that the user is properly logging in, but AFTER page refresh and should be immediately logged in without page reload. Need a fresh eyes to look at it. ...
WP Help Cat's user avatar
1 vote
1 answer
636 views

how to send Ajax request in wordpress backend

On the fronted the wp_localize_script seems to be working as when I view the source I can see the nonce. wp_localize_script('scripts', 'myAjax', array( 'root_url' => get_site_url(), '...
user8463989's user avatar
2 votes
0 answers
698 views

Nonces, AJAX, script variables & security in WordPress

Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using: wp_enqueue_script( 'script_handle', PATH_TO_SCRIPT, array(), '1.0.0', true ); ...
DevelJoe's user avatar
  • 497
1 vote
1 answer
3k views

permission_callback has no effect

WP version is 5.5.3 I have 3 API routes set in a plugin that is used in an admin dashboard page. One route is meant to be used "publicly". I have two very curious issues happening: My 3 ...
James Wagoner's user avatar
0 votes
1 answer
470 views

CSP nonces with Cloudflare Workers

Like this blog, I use Cloudflare Workers to inject CSP (Content Security Policy) nonce in headers : https://scotthelme.co.uk/csp-nonces-the-easy-way-with-cloudflare-workers/ This is functional. Next, ...
sebfaed's user avatar
3 votes
1 answer
1k views

Identical wp_rest nonce returned from rest_api

TLDR: How can I force a new nonce to be returned, so that AJAX works without refreshing the page? Following on from Nonces and Ajax request to REST API and verification I implemented the Nonce ...
Rob's user avatar
  • 157
2 votes
1 answer
2k views

Nonces and Ajax request to REST API and verification

Building my first WordPress in over a decade... using Timber for MVC. Vue on the frontend, and axios for ajax posts. All hosted on the same domain, so I can use cookies for authentication. I am ...
Rob's user avatar
  • 157
0 votes
1 answer
4k views

Using a nonce Content Security Policy header for style-src for inline style elements returns errors

When using a nonce in a Content Security Policy header, both Google Chrome and Firefox return errors. The nonce value is for a style element i.e. <style id="some-id">// CSS </style&...
Ryan's user avatar
  • 53
1 vote
1 answer
1k views

Found 2 elements with non-unique id (#_ajax_nonce) and (#_wpnonce)

I am developing custom theme from scratch and creates a custom post type and getting this warning while editing custom post type. I also design custom Meta box with two input fields and using nonce in ...
Ali Mirza's user avatar
0 votes
1 answer
269 views

Wordpress JSON API nonces and Vue development server

As stated in the official docs, the JSON API CSRF protection only works from within Wordpress. It is important to keep in mind that this authentication method relies on WordPress cookies. As a result ...
Hans's user avatar
  • 551
0 votes
1 answer
2k views

WordPress is creating nonce as a logged in user but verifying it incorrectly

I'm having trouble validating a nonce created with wp_create_nonce() inside a hidden input with the name nonce in an html form: <input type="hidden" name="nonce" value="<...
dewd's user avatar
  • 179
0 votes
1 answer
400 views

Change button link to add nonce

I am making a Logout button, but in order for it to work properly the link needs to have the correct nonce ("site.com/wp-login.php?action=logout&wp_nonce=X". I have found in another ...
Filipe Rocha's user avatar
1 vote
1 answer
922 views

Verify a nonce in Form submission

I am new in using Nonce.I am using Nonce like below in a Form wp_nonce_field('add_new_addres','add_new_address'); I am trying to verify Nonce like below if(isset( $_REQUEST['action'] ) &&...
abu abu's user avatar
  • 203
0 votes
0 answers
256 views

wp_verify_nonce not working on the mobile device

I am using a very simple form request to and verify it through the wp_verify_nonce() function. It is working perfectly on the desktop. But not working on mobile devices( iPhone, Andriod ). Could ...
jogesh_pi's user avatar
  • 267
0 votes
1 answer
3k views

How to not cache nonces with WP Rocket?

We have a system where we pass a nonce from a PHP-script on the server to an AJAX-call running client-side, and then back again to check the validity of the request. This nonce is cached, and we can'...
TASan's user avatar
  • 42

1
2 3 4 5