Questions tagged [nonce]
The nonce tag has no usage guidance.
215
questions
0
votes
1
answer
20
views
How do i set up ajax nonce
Follow the doc, I tried to set up X-WP-NONCE before ajax sent data to custom route, but it show wpApiSettings.nonce not defined. If don't set beforeSend, on the back end still can pass the nonce ...
- 1
0
votes
0
answers
16
views
WooCommerce Order Sync via Custom REST API Endpoint Failing
I have a WooCommerce website with a specialized plugin that syncs orders to a delivery company. This plugin adds a button next to each order in the orders table, which, when clicked, triggers a sync. ...
- 1
0
votes
0
answers
23
views
1st dynamic table row content is not saved on initial update
This is what is used in my plugin. A meta field that allows the user in a page editor to add table rows and three columns. As many rows as needed. The issue I am facing is I add a row, then populate ...
0
votes
1
answer
42
views
Saving metabox updates causing fatal error
I'm teaching myself from a plugin tutorial dvd, everything was going fine.
I've setup custom_post_types and the metaboxes with no issues. The issue i have is a fatal error when i update/publish the ...
0
votes
0
answers
116
views
Rest API nonce is being cached
I'm building a custom Rest Api endpoint. User can call this endpoint via ajax request in the frontend together with nonce value which was created by
wp_localize_script( 'some-js', 'wpApiSettings', [
...
- 1
1
vote
1
answer
337
views
Logout button in menu without "wp" in links
Update: This question was initially about how to log a user out without confirmation, but from a "pretty" URL without a logout nonce. However, in retrospect I realize this is a security ...
- 15
0
votes
1
answer
78
views
Wp doesn't save meta box data
My WP doesn't save my meta box data. I see the metabox and the field, but the data doesn't saving. Somebody could help me? Thank you. This is the code:
// 1. Metabox létrehozása
function my_meta_box(){...
- 1
0
votes
0
answers
65
views
Weird nonce validation problem
I have a front-end form (ie, should work for non-logged-in users) with a nonce - "my-nonce-name". The problem is that it sometimes verifies upon submission and sometimes not, for - to me - ...
- 25
0
votes
1
answer
179
views
Where to use nonce
I am learning WordPress Plugin Development. My Code is like below.
class Admin
{
public function __construct()
{
add_action( 'admin_menu', [$this,'news_meta_boxes'] );
...
- 417
1
vote
1
answer
33
views
How to use nonce
I am learning Plugin development. I have several MetaBox call back functions. In this regard where should I use wp_nonce_field() ?
- 183
0
votes
1
answer
41
views
How to use the wpsnonce clone post link?
I have this link from a CPT, to clone a post, in this case post=30808:
https://domain.com/wp-admin/admin.php?action=duplicate_post_clone&post=30808&_wpnonce=240f0078e7
Now, I need to use this ...
- 27
1
vote
1
answer
24
views
Restrict Access without Creating Users
I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill ...
- 541
0
votes
1
answer
72
views
How to obtain "wp_rest" nonce for WP Statistics plugin manually?
During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed.
To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-...
- 101
1
vote
0
answers
438
views
Log in user using Wordpress REST API
I am having problems authenticating a user after logging in using a custom endpoint using the WordPress REST API.
I'm aware that this is not the perfect approach but I am just trying to make a few ...
- 153
1
vote
1
answer
390
views
WordPress wp_localize_script nonce and ajax URL
I'm making an Ajax call in an Elementor site, and I'd like to use a nonce while doing it. Since my code is really simple, I didn't create a new JS file for it placed in Elementor's HTML widget, and I ...
- 13
0
votes
0
answers
64
views
How to verify which WordPress user requested the API in ASP .NET Core?
I have a use-case where I have a WordPress site and an ASP .NET Core as a Restful API backend. I use the WordPress site entire for Frontend, CMS, and User Authentication.
On certain pages of my ...
0
votes
0
answers
135
views
WP_List_Table Inside Metabox With Bulk Actions Not Working on Submit
I'm trying to display a WP_List_table inside a metabox. The metabox is for questions which are from assessment_question custom post type.The metabox is being displayed on an other custom post type '...
0
votes
1
answer
64
views
WordPress "nonce" message
Random question but I can't work it out or find a solution. I need to find a way to change the WordPress "nonce" message.
I'd like to replace to replace "nonce" with "error&...
- 103
0
votes
0
answers
1k
views
Reliable way to add nonce to HTTP Header in WordPress?
I am trying to implement CSP on my wordpress site.
Inspired by this question, https://stackoverflow.com/questions/50002041/adding-nonce-to-script-tag I tried to build a way to add nonces to my ...
- 266
1
vote
0
answers
319
views
"The link you followed has expired" & "Error while saving" messages when adding new post
I'm currently unable to publish new posts on my wordpress site. Whenever I try, I get a "The link you followed has expired" error after clicking the "publish" button. Also, as I'm ...
- 81
0
votes
1
answer
732
views
wp_verify_nonce return false despite correct parameter passed
I have created a form that have nonce
<form action="<?php echo get_rest_url(null, 'ilms_plugin/new_membership') ?>" method="post" class=' space-y-2 mt-2 p-2 rounded-md '&...
- 37
0
votes
2
answers
3k
views
Log out without confirmation request (nonce)
I have a Wordpress site with WooCommerce. I would like to add a Logout option to the Menu that logs out the user without asking for confirmation.
So I included a menu custom link with as URL: /my-...
- 117
0
votes
1
answer
436
views
Extend Nonce Lifetime for Specific Nonce Creation
I've got as far as successfully filtering the global nonce_life but am running into trouble applying the filter in a specific function in the way described in this answer.
function ...
- 541
0
votes
1
answer
481
views
wp_nonce vs jwt
I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend.
What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
user179669
0
votes
1
answer
919
views
Why does check_ajax_referer give a 403 error on https websites?
When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended.
But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
- 128
1
vote
1
answer
238
views
Nonce failing on form submission
I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1
answer
206
views
SSO autologin Wordpress + Ajax
That one keeps me awake at night.
The problem is that the user is properly logging in, but AFTER page refresh and should be immediately logged in without page reload. Need a fresh eyes to look at it.
...
- 15
1
vote
1
answer
413
views
how to send Ajax request in wordpress backend
On the fronted the wp_localize_script seems to be working as when I view the source I can see the nonce.
wp_localize_script('scripts', 'myAjax', array(
'root_url' => get_site_url(),
'...
- 503
2
votes
0
answers
567
views
Nonces, AJAX, script variables & security in WordPress
Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using:
wp_enqueue_script(
'script_handle',
PATH_TO_SCRIPT,
array(),
'1.0.0',
true
);
...
- 467
1
vote
1
answer
3k
views
permission_callback has no effect
WP version is 5.5.3
I have 3 API routes set in a plugin that is used in an admin dashboard page. One route is meant to be used "publicly".
I have two very curious issues happening:
My 3 ...
0
votes
1
answer
397
views
CSP nonces with Cloudflare Workers
Like this blog, I use Cloudflare Workers to inject CSP (Content Security Policy) nonce in headers : https://scotthelme.co.uk/csp-nonces-the-easy-way-with-cloudflare-workers/
This is functional.
Next, ...
- 1
2
votes
1
answer
929
views
Identical wp_rest nonce returned from rest_api
TLDR: How can I force a new nonce to be returned, so that AJAX works without refreshing the page?
Following on from Nonces and Ajax request to REST API and verification I implemented the Nonce ...
- 147
2
votes
1
answer
1k
views
Nonces and Ajax request to REST API and verification
Building my first WordPress in over a decade... using Timber for MVC. Vue on the frontend, and axios for ajax posts. All hosted on the same domain, so I can use cookies for authentication.
I am ...
- 147
0
votes
1
answer
3k
views
Using a nonce Content Security Policy header for style-src for inline style elements returns errors
When using a nonce in a Content Security Policy header, both Google Chrome and Firefox return errors. The nonce value is for a style element i.e. <style id="some-id">// CSS </style&...
- 43
1
vote
1
answer
976
views
Found 2 elements with non-unique id (#_ajax_nonce) and (#_wpnonce)
I am developing custom theme from scratch and creates a custom post type and getting this warning while editing custom post type. I also design custom Meta box with two input fields and using nonce in ...
- 11
0
votes
1
answer
217
views
Wordpress JSON API nonces and Vue development server
As stated in the official docs, the JSON API CSRF protection only works from within Wordpress.
It is important to keep in mind that this authentication method relies on WordPress cookies. As a result ...
- 531
0
votes
1
answer
1k
views
WordPress is creating nonce as a logged in user but verifying it incorrectly
I'm having trouble validating a nonce created with wp_create_nonce() inside a hidden input with the name nonce in an html form:
<input type="hidden" name="nonce" value="<...
- 170
0
votes
1
answer
344
views
Change button link to add nonce
I am making a Logout button, but in order for it to work properly the link needs to have the correct nonce ("site.com/wp-login.php?action=logout&wp_nonce=X".
I have found in another ...
- 101
0
votes
1
answer
615
views
Verify a nonce in Form submission
I am new in using Nonce.I am using Nonce like below in a Form
wp_nonce_field('add_new_addres','add_new_address');
I am trying to verify Nonce like below
if(isset( $_REQUEST['action'] ) &&...
- 183
0
votes
0
answers
243
views
wp_verify_nonce not working on the mobile device
I am using a very simple form request to and verify it through the wp_verify_nonce() function. It is working perfectly on the desktop. But not working on mobile devices( iPhone, Andriod ). Could ...
- 267
0
votes
1
answer
2k
views
How to not cache nonces with WP Rocket?
We have a system where we pass a nonce from a PHP-script on the server to an AJAX-call running client-side, and then back again to check the validity of the request.
This nonce is cached, and we can'...
- 42
0
votes
0
answers
39
views
How do I mitigate replay attacks when talking about actions that shouldn't happen twice?
A nonce is supposed to first help me against CSRF and help against replay attacks is just a bonus if I "personalize" the nonce to something like pay-user-{id}, but here's the problem - if my link ...
- 174
1
vote
0
answers
461
views
Draft preview and customize permission problems on multisite main site
So I've been stuck on this problem for quite a while now and it feels like I've tried everything. I would love for some support here.
Setup
A WordPress multisite with Bedrock structure
PHP 7.3.17 (...
- 11
2
votes
1
answer
2k
views
Can't GET draft posts via REST API from headless frontend
I have a headless install of Wordpress on v5.4.0. The frontend can't GET any post that is in draft status, though when accessing the API url directly the data is returned without an issue. I'm ...
- 31
4
votes
1
answer
4k
views
Properly applying nonce to a form using AJAX
So I'm still learning around WordPress and can't seem to figure out how to properly hook a nonce into a AJAX Form that I have created.
Here I am hooking and localizing the js file and defining a ...
- 209
0
votes
1
answer
301
views
Why are nonces working in Firefox but not in Chrome?
I created the nonce when I localize a script file:
wp_localize_script('cad-search', 'cad_ajax',
array( 'ajaxurl' => admin_url( 'admin-ajax.php' ),
'nonce'=> wp_create_nonce('...
- 691
0
votes
1
answer
351
views
Backbone with custom rest endpoints
I have created a custom endpoint that returns select user meta data. I am trying to access this endpoint with Backbone. It works as expected in Postman and from my Backbone/javascript script If I have ...
- 53
0
votes
1
answer
381
views
Is it safe to use a global wp nonce per user instead of a nonce per action?
Please refer to my comments on Greg's answer for more details in relation to his answer which are also relevant to this.
I'm routing all my AJAX requests through a Controller, this is a class that ...
- 53
1
vote
0
answers
357
views
x-wp-nonce across domains
I've installed WPML with a multiple domain configuration (one domain per language).
The wrong thing is that, when editing for example a post while using a different domain from the main, it just ...
- 85
0
votes
0
answers
97
views
whether a nonce is required for get type and get_query_var?
I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not.
I use the get_query_var method to modify the main query. It uses a get method.
whether a nonce is ...
user145078