Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nonce]

The tag has no usage guidance.

0
votes
0answers
16 views

wp_nonce_url generating invalid links

My goal is to allow users to delete posts they own from the front end. I have an API that returns some JSON along with a link to delete their post. $delLink = wp_nonce_url( site_url() . "/wp-admin/...
0
votes
1answer
18 views

Verify nonce in REST API?

I would like to understand the best practices regarding nonce validation in REST APIs. I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
3
votes
0answers
83 views

WordPress REST API call generates nonce twice on every call

I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
0
votes
1answer
16 views

Re-use Nonce in Repeating Event Signup Buttons

My understanding is that wordpress nonces (not exactly a "number used once") prevent cross-origin request forgery and last 12 hours. I'm displaying a schedule of classes with a registration button ...
1
vote
1answer
53 views

WP Admin AJAX Security - using POST to include a relative URL

I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's. The only "real" difference between these scripts ...
2
votes
0answers
173 views

WordPress “Link has expired” error on updating posts

I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
0
votes
1answer
41 views

Override plugin function to show invoices even if not logged in

I am using WooCommerce Print Invoice plugin to print invoices. Now I am working on a Cordova app for my website and I need to be able to see invoices from wordpress. Plugin has a function to hide or ...
0
votes
0answers
17 views

Undefined Index: post_type error on Adding New Page due to nonce

It apparently seem like a duplicate question (Undefined 'post_type' error on Add new page), I've tried solving since a last few hours along with researching and now it's time to ask from ...
1
vote
1answer
22 views

Confusion regarding Nonce & using it in Custom Columns for Saving Checkbox Value to Post Meta

I believe there are multiple ways to use nonce. Recently I've used wp_nonce_field('any_nonce_value'); which creates a <input type="hidden" id="_wpnonce" name="_wpnonce" value="111bc61eba"> ...
1
vote
0answers
33 views

Wordpress password reset - why post rp_key?

I'm developing a plugin and after reading through wp-login.php, I can't seem to work out why some things are done the way they are. Why does WordPress hide the reset password key from the URL? After ...
0
votes
0answers
40 views

How can I verify WordPress nonce from the following code?

<?php /** * Template Name: Manage Days */ if ( isset($_GET['remove_date']) && isset($_GET['_wpnonce']) ) { $delete_date = $_GET['remove_date']; $delete_nonce = $_GET['_wpnonce']; ...
0
votes
1answer
113 views

Rest API invalid nonce with Backbone Client

I'm using the built-in Backbone Client whenever I try to make a request it gives me this error: {"code":"rest_cookie_invalid_nonce","message":"Cookie nonce is invalid","data":{"status":403}} I read ...
0
votes
0answers
439 views

AJAX form not working, still reloads on submit

I've built a like and unlike system for users, and it works amazingly. The only problem is the page reloads, therefore, I've tried to set up AJAX to submit the form without a page refresh. However, it'...
0
votes
0answers
23 views

Passing nonce at admin menu link

I'm trying to pass a nonce at the links created from my plugin using add_menu_page and add_submenu_page. Of course this is invalid: add_submenu_page( 'my_dashboard', 'Dashboard', 'Dashboard', '...
0
votes
1answer
28 views

phpcs error in WordPress

I'm working with the MegaMenu here echo wp_nonce_url() is showing an error All output should run through an escaping function according to wpcs. I gave echo esc_url( wp_nonce_url()) Is it correct? ...
0
votes
1answer
21 views

How to verify nonces in bulk?

Hey I'm relatively new to WP, and I'm trying to get a handle on nonces since they're a good security check. I'm having difficulty verifying my nonces in save_post however. The checks fail on the $...
0
votes
0answers
196 views

Are nonces in WP REST API optional by default?

I'm switching my code from using wp-ajax to the REST API and got puzzled regarding the nonces. First of all, I find it weird that you have to use wp_rest only, since API has many different methods and ...
0
votes
0answers
150 views

Set nonces correctly for a JSON REST API v2 (WP 4.8.5)

I'm using Gravity Forms, and I want to use a jQuery script to set some defaults in my form. Whenever the user dropdown changes, fetch all the roles belonging to the chosen user. I thought the simplest ...
3
votes
1answer
1k views

Getting “The link you followed has expired” when adding custom post [closed]

EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, ...
1
vote
0answers
246 views

Full page NGINX (or Cloudflare) caching and WordPress nonces

Goal: I want to cache the full WordPress response via NGINX and exclusively use the REST API for the user specific parts. Issue: I can't get an authenticated nonce to use against the API. My plan ...
1
vote
1answer
232 views

Custom login doesn't work properly

I've a made a plugin which generates a login form, by using a shortcode. The login works, however, inside the dashboard I've noticed that the forms submits don't work properly. For example, the ...
5
votes
2answers
714 views

How do WordPress Nonces Work?

I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
0
votes
0answers
194 views

CSRF attack to create USER

I'm looking for to fix the issue below : The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress: The attacker sends malicious html page to an ...
1
vote
2answers
147 views

Why am I getting a 403 from check_admin_referer()?

I've written a class to play about with ajax. I had originally used check_admin_referer (in hello()) without arguments but got this warning: "PHP Notice: check_admin_referer was called incorrectly. ...
8
votes
3answers
2k views

Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script

For those that arrive from Google: You probably shouldn't get the nonces from the REST API, unless you really know what you're doing. Cookie-based authentication with the REST API is only meant for ...
0
votes
1answer
195 views

Register rest field authentication with REST API

I'm trying to add some user meta information to the existing wp/v2/users REST endpoint. However, it looks like additional authentication is required, i.e. I get this (output in comments): ...
0
votes
0answers
42 views

Localized nonce being cached by Service Worker and eventually failing

I've been having success using nonces for years now, but recently I implemented a Service Worker onto my website. I love the technology and it has drastically improved things like load times. ...
1
vote
1answer
113 views

increase nonce lifespan

I want to increase the nonce lifespan from the default 12-24h, to 36-48h. I found the following code in the codex, but don't know where to put it. add_filter( 'nonce_life', function () { return ...
1
vote
1answer
251 views

Handling expired nonces

I have a page with a few buttons. When people click on the buttons they issue AJAX requests and update various parts of the page. The AJAX requests make use of nonces for security purposes. I ...
2
votes
1answer
169 views

How to add Wordpress nonces to ajax request

I have a plugin, a cron job runs refresh_my_plugin() daily. I need a button on my plugins Settings/option page, allowing a user to manually run said function, and I want it inline, with ajax. I've ...
0
votes
1answer
65 views

Stop WordPress nonces expiring

I would like to have nonce key forever, i don't want to change or refresh. Any idea? add_filter( 'nonce_life', function () { return 4 * 1000000000000000000; } );
0
votes
1answer
223 views

Unable to successfully verify nonce

I'm developing a plugin (for the first time) and I'm trying to be responsible and include a nonce in my Ajax call. I've looked at a dozen tutorials, all with different approaches, and I thought I had ...
0
votes
2answers
107 views

javascript ajax and nonce

I am struggling to implement nonces through XML request to php backend using the Wordpress nonce validation when creating forms dynamically. I am ok with the form built version wp_nonce_field( '...
0
votes
1answer
312 views

How to add a WordPress Nonce for this form to avoid CSRF

Here is the Form and I would like to add a WordPress nonce to it: <form action="" method="post"> <label>Enter your email address:</label> <input id="email" ...
0
votes
2answers
193 views

When must I use and verify nonce?

I'm developing a WordPress site which posts a number of ajax calls from jquery to PHP and returns data from PHP to jquery. I need to know when must I use and verify nonce?
0
votes
1answer
150 views

Reduce nonce lifespan

for a personal plugin (nothing going to the public or commercial), I built an AJAX form and its endpoint is a custom endpoint (REST Api). When a certain Page containing my form is accessed, I ...
1
vote
2answers
1k views

WP REST API - Nonce passes wp_verify_nonce even after logout

I'm creating a single page app with WP REST API and AngularJS. After solving a problem with nonces on this question, now i'm facing something else. To test the chance of adding fields and making them ...
0
votes
1answer
2k views

WP REST API: check if user is logged in

The idea is to show or hide some sections of the site in a theme that's fetching all data from the REST API, using AngularJS. I thought this check would help me (nonce is passed as header, as ...
2
votes
1answer
417 views

Using nonce in menu item

I have a log out link in the main header menu, when you click on the link to log out, you are redirected to the page asking if you really want to log out. I know it's doing this because there is no ...
0
votes
1answer
125 views

Cannot verify nonce

I create nonce as $nonce = wp_create_nonce("action"); And then send the email with nonce to user. In the email there is the link to a page. In the page I form the nonce the same way and try to ...
1
vote
0answers
477 views

wp_create_nonce() in REST API makes user->ID zero

I have trouble with wp_create_nonce() and wp_verify_nonce(). The root of my problem is both the way nonces are created and the place where I generate nonces. Looking at the codes of wp_create_nonce()...
0
votes
1answer
164 views

check_admin_referer not working in custom meta box for custom post type

In my callback function (the one which output HTML for forms) of add_meta_box, I am using wp_nonce_field( 'uniqueid', 'my_nonce' ) Now in saving function, I am using this at top to verify nonce ...
1
vote
0answers
237 views

Encountering “Wrong nonce. Action prohibitied.” when trying to alter User Role and unable to Post via WP Admin

The plugin in question that I believe is displaying this message is the User Role Editor, although I do not believe it is causing the issue as users who should have permissions to make posts on the ...
4
votes
2answers
5k views

How do I create a user using the new JSON api in 4.7?

I formerly had the JSON API and JSON USER API plugins working before 4.7 and I have seen the documentation at the ReST API User reference, https://developer.wordpress.org/rest-api/reference/users/#...
3
votes
1answer
767 views

wp_verify_nonce() via REST always returns false

I'm trying to create and verify nonce, and I did it almost the same way as described in wp_create_nonce. I believe it's related to REST api, but not sure where to investigate? How I create nonce: (...
2
votes
1answer
61 views

Nonce failing in IE

I have a strange issue that seems to affect IE but not Chrome (I haven't tried any other browsers) I'm generating a form with a nonce using the following code - <?php wp_nonce_field('solution-reg'...
1
vote
2answers
351 views

How do I check if AJAX nonces are implemented correctly?

I have a simple "favorite post" button that works with AJAX. I understand that using a WordPress nonce improves security, but am not quite sure why or how it does this. This also makes me unable to ...
0
votes
1answer
44 views

Does this code indicate an exploit?

I have just started seeing this code on a single Page on our site. This Page is assigned as the static home page for the site. <input name="_wp_http_referer" value="/" type="hidden"> <input ...
0
votes
2answers
367 views

Why save_post_$(custom_post_type) is fired even if I am not already saving a post?

I'm registering a custom post type named Datasheet. When registering it, I register the callback for meta boxes 'register_meta_box_cb' => [ $this, "add_metaboxes" ] This is my callback function ...
2
votes
1answer
312 views

Should nonce be sanitized?

The general guideline is that we should sanitize all user input before using them. Now my questions is whether this applies to nonce or not. Which one is correct? wp_verify_nonce( ...