Questions tagged [nonce]
The nonce tag has no usage guidance.
172
questions
0
votes
0answers
5 views
Is it safe to use a global wp nonce per user instead of a nonce per action?
I'm routing all my AJAX requests through a Controller, this is a class that simply localizes an endpoint and calls it further, as such, it's some sort of a router, it does some checks first:
This ...
0
votes
0answers
14 views
Problem with ajax login/logout and nonces
My current flow is as follows:
I use wp_localize_script to generate a nonce which my javascript can use.
I pass this nonce with my login and logout request. When I login I touch the dom by removing ...
1
vote
0answers
28 views
x-wp-nonce across domains
I've installed WPML with a multiple domain configuration (one domain per language).
The wrong thing is that, when editing for example a post while using a different domain from the main, it just ...
0
votes
0answers
15 views
Is a global nonce a bad idea?
I'm trying to build a central system that will delegate certain functionality and serve me some nice things when dealing with AJAX calls. Basically, I want to dumb the whole charade of checking ...
0
votes
0answers
25 views
Nonce timing out when cache is in use
I have implemented a plugin that allows an individual to search data that is available from the plugin and receive a list of results back from that search. Searching is the only act that can be ...
0
votes
0answers
18 views
whether a nonce is required for get type and get_query_var?
I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not.
I use the get_query_var method to modify the main query. It uses a get method.
whether a nonce is ...
0
votes
0answers
26 views
Unable to update plugins or log out
The server my site was hosted on recently went down and someone else was able to fix it for me. I am unclear on what exactly the issues with the server were, but since the site came back up, my cron ...
1
vote
0answers
32 views
Is nonce in PHP form and Ajax both necessary?
I have a php form which is submitted through jQuery Ajax. Previously i had used nonce with Ajax and PHP form seperately.
Here i am using wp_nonce_field() in PHP form. Is it necessary to use ...
2
votes
1answer
28 views
When is it useful to use wp_verify_nonce
I know that wp_verify_nonce() is used to make sure that the $_POST is coming from a safe place.
I am developing a WordPress plugin which creates custom lists. In order to do that the web site owner ...
2
votes
1answer
152 views
Headless Wordpress: How to authenticate front end requests?
I am envisioning Wordpress on the back end to work with React.js on the front end like this:
Wordpress is installed on http://example.com/api
React.js script is loaded into http://example.com/index....
1
vote
1answer
63 views
Passing a borrowed nonce through Postman fails
I'm trying to test borrowing a nonce from my browser session so that I can use it elsewhere, namely in my npm dev environment.
I took a nonce passed into an open Chrome browser session, put it in a ...
1
vote
1answer
77 views
WP nonce invalid
Have a quick script to search for untranslated pages, and then returning a translate link. (Polylang makes a new post for a translation, which is then linked to the original.)
All is working well, ...
0
votes
1answer
94 views
Rest API: wp_verify_nonce() fails despite receiving correct nonce value
I am generating a nonce to be used with client side fetch requests to the rest api:
function prepAllAdminScripts() {
wp_register_script(
'reactAdminArea'
, PLUGIN_FOLDER_URL . 'shared/...
0
votes
0answers
20 views
Does it make sense to check a nonce on user log in?
I read the following blog post about implementing custom user log in:
http://natko.com/wordpress-ajax-login-without-a-plugin-the-right-way/
In the post, the author walks through some PHP code for ...
1
vote
0answers
82 views
wp_create_nonce doesn't verify when using WP_List_Table
I've created an admin page where I'm displaying a list of a MySQL Table using WP_List_Table.
In this table I need to be able to delete a record when I want to.
And that's where I have a problem.
To ...
0
votes
1answer
31 views
Custom Meta Boxes - Nonce Issue - Move to trash issue
Recently after updating Wordpress from 4.9.2 to 5.2, I have had to change a good bit of code to get my custom post type listings(or posts) to function and save data correctly. Specifically, with the ...
3
votes
2answers
142 views
Nonce in settings API with tabbed navigation
I'm rewording this because, as it's correctly been pointed out, the original post was "woefully inadequate." I made a plugin which has tabbed views for the various settings. It's based on this ...
1
vote
1answer
292 views
Wordpress REST API, Expired Nonce from Cache results in 403 forbidden
My wordpress site sits behind Akamai, which is a cacheing service similar to Cloudflare.
I make the following API call:
GET /wp-json/mytheme/v1/get-posts?post_type=videos
This is done using ...
0
votes
0answers
26 views
expired link error on front end
I have a custom form which I am using to save post meta but upon submission it is displaying this error. I have a form like this
<form action="<?= site_url() ?>/?action=edit&job=<?...
0
votes
0answers
28 views
wp_verfy_nonce keeps giving false
i have a form somthing like this
<form id="sample_docs" method="post" action="<?php echo admin_url('admin-ajax.php'); ?>">
<?php wp_nonce_field('nonce_action_sample_docs', '...
1
vote
1answer
27 views
Can a wp_nonce created from domain 1 to be verified on domain 2?
From the Domain 1 i want to make an AJAX request to Domain 2.
I would like to create a wp_nonce on Domain 1 and send it with AJAX request to Domain 2, then verify it on Domain 2.
The 2 domains are ...
0
votes
0answers
19 views
Nonce - reissue with ajax poll
I have a plugin which displays a map with markers. Using SetInterval I am refreshing the markers at a pre-determined interval using an ajax call.
It is only reading data, no updates.
I am using a ...
2
votes
1answer
196 views
Handling nonces for actions from guests to logged-in users
Imagine the following scenario:
John has an account on my website, but is currently not logged in.
He clicks the "upvote" button on an article, but is redirected to the login page because only logged-...
1
vote
0answers
15 views
Why ajax doesn't work on certain wordpress hooks and reload the page instead?
I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
0answers
26 views
Why ajax doesn't work on certain wordpress hooks?
I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
1answer
275 views
“The link you followed has expired” when previewing a post
Recently, I believe after switching to WP 5, non admin users are randomly getting the following error when previewing a post:
“The link you followed has expired” . Please try again
I am suspecting ...
0
votes
2answers
228 views
Serving nonces through AJAX is not refreshing nonce, returning 403 error
I have run into an issue with nonces becoming invalid, and being unable to refresh to a new nonce. In my example I have a Facebook Connect button, and a Facebook Disconnect button, each with their own ...
0
votes
1answer
66 views
How to check nonce lifetime value of plugins?
Dear StackExchange users,
I currently use the premium version of WP Fastest Cache Premium. My website loads very fast, but I always get a 403 error for wp-admin/ajax.
I believe there is a plugin ...
0
votes
0answers
99 views
wp_nonce_url generating invalid links
My goal is to allow users to delete posts they own from the front end. I have an API that returns some JSON along with a link to delete their post.
$delLink = wp_nonce_url( site_url() . "/wp-admin/...
3
votes
1answer
2k views
Verify nonce in REST API?
I would like to understand the best practices regarding nonce validation in REST APIs.
I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
3
votes
0answers
369 views
WordPress REST API call generates nonce twice on every call
I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
0
votes
1answer
30 views
Re-use Nonce in Repeating Event Signup Buttons
My understanding is that wordpress nonces (not exactly a "number used once") prevent cross-origin request forgery and last 12 hours.
I'm displaying a schedule of classes with a registration button ...
1
vote
1answer
433 views
WP Admin AJAX Security - using POST to include a relative URL
I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's.
The only "real" difference between these scripts ...
3
votes
0answers
866 views
WordPress “Link has expired” error on updating posts
I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
0
votes
1answer
80 views
Override plugin function to show invoices even if not logged in
I am using WooCommerce Print Invoice plugin to print invoices.
Now I am working on a Cordova app for my website and I need to be able to see invoices from wordpress.
Plugin has a function to hide or ...
1
vote
1answer
49 views
Confusion regarding Nonce & using it in Custom Columns for Saving Checkbox Value to Post Meta
I believe there are multiple ways to use nonce.
Recently I've used wp_nonce_field('any_nonce_value');
which creates a
<input type="hidden" id="_wpnonce" name="_wpnonce" value="111bc61eba">
...
1
vote
0answers
93 views
Wordpress password reset - why post rp_key?
I'm developing a plugin and after reading through wp-login.php, I can't seem to work out why some things are done the way they are.
Why does WordPress hide the reset password key from the URL?
After ...
0
votes
0answers
49 views
How can I verify WordPress nonce from the following code?
<?php
/**
* Template Name: Manage Days
*/
if ( isset($_GET['remove_date']) && isset($_GET['_wpnonce']) ) {
$delete_date = $_GET['remove_date'];
$delete_nonce = $_GET['_wpnonce'];
...
1
vote
1answer
349 views
Rest API invalid nonce with Backbone Client
I'm using the built-in Backbone Client whenever I try to make a request it gives me this error: {"code":"rest_cookie_invalid_nonce","message":"Cookie nonce is invalid","data":{"status":403}}
I read ...
0
votes
0answers
1k views
AJAX form not working, still reloads on submit
I've built a like and unlike system for users, and it works amazingly. The only problem is the page reloads, therefore, I've tried to set up AJAX to submit the form without a page refresh. However, it'...
0
votes
0answers
93 views
Passing nonce at admin menu link
I'm trying to pass a nonce at the links created from my plugin using add_menu_page and add_submenu_page.
Of course this is invalid:
add_submenu_page(
'my_dashboard',
'Dashboard',
'Dashboard',
'...
0
votes
1answer
38 views
phpcs error in WordPress
I'm working with the MegaMenu here echo wp_nonce_url() is showing an error All output should run through an escaping function according to wpcs. I gave echo esc_url( wp_nonce_url()) Is it correct? ...
0
votes
1answer
44 views
How to verify nonces in bulk?
Hey I'm relatively new to WP, and I'm trying to get a handle on nonces since they're a good security check. I'm having difficulty verifying my nonces in save_post however.
The checks fail on the $...
0
votes
0answers
536 views
Are nonces in WP REST API optional by default?
I'm switching my code from using wp-ajax to the REST API and got puzzled regarding the nonces. First of all, I find it weird that you have to use wp_rest only, since API has many different methods and ...
4
votes
1answer
2k views
Getting “The link you followed has expired” when adding custom post [closed]
EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, ...
1
vote
0answers
420 views
Full page NGINX (or Cloudflare) caching and WordPress nonces
Goal: I want to cache the full WordPress response via NGINX and exclusively use the REST API for the user specific parts.
Issue: I can't get an authenticated nonce to use against the API.
My plan ...
1
vote
1answer
238 views
Custom login doesn't work properly
I've a made a plugin which generates a login form, by using a shortcode. The login works, however, inside the dashboard I've noticed that the forms submits don't work properly. For example, the ...
6
votes
2answers
880 views
How do WordPress Nonces Work?
I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
0
votes
0answers
316 views
CSRF attack to create USER
I'm looking for to fix the issue below :
The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress:
The attacker sends malicious html page to an ...
1
vote
2answers
462 views
Why am I getting a 403 from check_admin_referer()?
I've written a class to play about with ajax. I had originally used check_admin_referer (in hello()) without arguments but got this warning: "PHP Notice: check_admin_referer was called incorrectly. ...
