Questions tagged [nonce]
The nonce tag has no usage guidance.
0
votes
0answers
16 views
wp_nonce_url generating invalid links
My goal is to allow users to delete posts they own from the front end. I have an API that returns some JSON along with a link to delete their post.
$delLink = wp_nonce_url( site_url() . "/wp-admin/...
0
votes
1answer
18 views
Verify nonce in REST API?
I would like to understand the best practices regarding nonce validation in REST APIs.
I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
3
votes
0answers
83 views
WordPress REST API call generates nonce twice on every call
I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
0
votes
1answer
16 views
Re-use Nonce in Repeating Event Signup Buttons
My understanding is that wordpress nonces (not exactly a "number used once") prevent cross-origin request forgery and last 12 hours.
I'm displaying a schedule of classes with a registration button ...
1
vote
1answer
53 views
WP Admin AJAX Security - using POST to include a relative URL
I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's.
The only "real" difference between these scripts ...
2
votes
0answers
173 views
WordPress “Link has expired” error on updating posts
I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
0
votes
1answer
41 views
Override plugin function to show invoices even if not logged in
I am using WooCommerce Print Invoice plugin to print invoices.
Now I am working on a Cordova app for my website and I need to be able to see invoices from wordpress.
Plugin has a function to hide or ...
0
votes
0answers
17 views
Undefined Index: post_type error on Adding New Page due to nonce
It apparently seem like a duplicate question (Undefined 'post_type' error on Add new page), I've tried solving since a last few hours along with researching and now it's time to ask from ...
1
vote
1answer
22 views
Confusion regarding Nonce & using it in Custom Columns for Saving Checkbox Value to Post Meta
I believe there are multiple ways to use nonce.
Recently I've used wp_nonce_field('any_nonce_value');
which creates a
<input type="hidden" id="_wpnonce" name="_wpnonce" value="111bc61eba">
...
1
vote
0answers
33 views
Wordpress password reset - why post rp_key?
I'm developing a plugin and after reading through wp-login.php, I can't seem to work out why some things are done the way they are.
Why does WordPress hide the reset password key from the URL?
After ...
0
votes
0answers
40 views
How can I verify WordPress nonce from the following code?
<?php
/**
* Template Name: Manage Days
*/
if ( isset($_GET['remove_date']) && isset($_GET['_wpnonce']) ) {
$delete_date = $_GET['remove_date'];
$delete_nonce = $_GET['_wpnonce'];
...
0
votes
1answer
113 views
Rest API invalid nonce with Backbone Client
I'm using the built-in Backbone Client whenever I try to make a request it gives me this error: {"code":"rest_cookie_invalid_nonce","message":"Cookie nonce is invalid","data":{"status":403}}
I read ...
0
votes
0answers
439 views
AJAX form not working, still reloads on submit
I've built a like and unlike system for users, and it works amazingly. The only problem is the page reloads, therefore, I've tried to set up AJAX to submit the form without a page refresh. However, it'...
0
votes
0answers
23 views
Passing nonce at admin menu link
I'm trying to pass a nonce at the links created from my plugin using add_menu_page and add_submenu_page.
Of course this is invalid:
add_submenu_page(
'my_dashboard',
'Dashboard',
'Dashboard',
'...
0
votes
1answer
28 views
phpcs error in WordPress
I'm working with the MegaMenu here echo wp_nonce_url() is showing an error All output should run through an escaping function according to wpcs. I gave echo esc_url( wp_nonce_url()) Is it correct? ...
0
votes
1answer
21 views
How to verify nonces in bulk?
Hey I'm relatively new to WP, and I'm trying to get a handle on nonces since they're a good security check. I'm having difficulty verifying my nonces in save_post however.
The checks fail on the $...
0
votes
0answers
196 views
Are nonces in WP REST API optional by default?
I'm switching my code from using wp-ajax to the REST API and got puzzled regarding the nonces. First of all, I find it weird that you have to use wp_rest only, since API has many different methods and ...
0
votes
0answers
150 views
Set nonces correctly for a JSON REST API v2 (WP 4.8.5)
I'm using Gravity Forms, and I want to use a jQuery script to set some defaults in my form. Whenever the user dropdown changes, fetch all the roles belonging to the chosen user. I thought the simplest ...
3
votes
1answer
1k views
Getting “The link you followed has expired” when adding custom post [closed]
EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, ...
1
vote
0answers
246 views
Full page NGINX (or Cloudflare) caching and WordPress nonces
Goal: I want to cache the full WordPress response via NGINX and exclusively use the REST API for the user specific parts.
Issue: I can't get an authenticated nonce to use against the API.
My plan ...
1
vote
1answer
232 views
Custom login doesn't work properly
I've a made a plugin which generates a login form, by using a shortcode. The login works, however, inside the dashboard I've noticed that the forms submits don't work properly. For example, the ...
5
votes
2answers
714 views
How do WordPress Nonces Work?
I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
0
votes
0answers
194 views
CSRF attack to create USER
I'm looking for to fix the issue below :
The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress:
The attacker sends malicious html page to an ...
1
vote
2answers
147 views
Why am I getting a 403 from check_admin_referer()?
I've written a class to play about with ajax. I had originally used check_admin_referer (in hello()) without arguments but got this warning: "PHP Notice: check_admin_referer was called incorrectly. ...
8
votes
3answers
2k views
Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script
For those that arrive from Google: You probably shouldn't get the nonces from the REST API, unless you really know what you're doing. Cookie-based authentication with the REST API is only meant for ...
0
votes
1answer
195 views
Register rest field authentication with REST API
I'm trying to add some user meta information to the existing wp/v2/users REST endpoint. However, it looks like additional authentication is required, i.e. I get this (output in comments):
...
0
votes
0answers
42 views
Localized nonce being cached by Service Worker and eventually failing
I've been having success using nonces for years now, but recently I implemented a Service Worker onto my website. I love the technology and it has drastically improved things like load times. ...
1
vote
1answer
113 views
increase nonce lifespan
I want to increase the nonce lifespan from the default 12-24h, to 36-48h.
I found the following code in the codex, but don't know where to put it.
add_filter( 'nonce_life', function () { return ...
1
vote
1answer
251 views
Handling expired nonces
I have a page with a few buttons. When people click on the buttons they issue AJAX requests and update various parts of the page. The AJAX requests make use of nonces for security purposes.
I ...
2
votes
1answer
169 views
How to add Wordpress nonces to ajax request
I have a plugin, a cron job runs refresh_my_plugin() daily.
I need a button on my plugins Settings/option page, allowing a user to manually run said function, and I want it inline, with ajax.
I've ...
0
votes
1answer
65 views
Stop WordPress nonces expiring
I would like to have nonce key forever, i don't want to change or refresh. Any idea?
add_filter( 'nonce_life', function () { return 4 * 1000000000000000000; } );
0
votes
1answer
223 views
Unable to successfully verify nonce
I'm developing a plugin (for the first time) and I'm trying to be responsible and include a nonce in my Ajax call. I've looked at a dozen tutorials, all with different approaches, and I thought I had ...
0
votes
2answers
107 views
javascript ajax and nonce
I am struggling to implement nonces through XML request to php backend using the Wordpress nonce validation when creating forms dynamically. I am ok with the form built version
wp_nonce_field( '...
0
votes
1answer
312 views
How to add a WordPress Nonce for this form to avoid CSRF
Here is the Form and I would like to add a WordPress nonce to it:
<form action="" method="post">
<label>Enter your email address:</label> <input id="email" ...
0
votes
2answers
193 views
When must I use and verify nonce?
I'm developing a WordPress site which posts a number of ajax calls from jquery to PHP and returns data from PHP to jquery.
I need to know when must I use and verify nonce?
0
votes
1answer
150 views
Reduce nonce lifespan
for a personal plugin (nothing going to the public or commercial), I built an AJAX form and its endpoint is a custom endpoint (REST Api).
When a certain Page containing my form is accessed, I ...
1
vote
2answers
1k views
WP REST API - Nonce passes wp_verify_nonce even after logout
I'm creating a single page app with WP REST API and AngularJS. After solving a problem with nonces on this question, now i'm facing something else.
To test the chance of adding fields and making them ...
0
votes
1answer
2k views
WP REST API: check if user is logged in
The idea is to show or hide some sections of the site in a theme that's fetching all data from the REST API, using AngularJS.
I thought this check would help me (nonce is passed as header, as ...
2
votes
1answer
417 views
Using nonce in menu item
I have a log out link in the main header menu, when you click on the link to log out, you are redirected to the page asking if you really want to log out. I know it's doing this because there is no ...
0
votes
1answer
125 views
Cannot verify nonce
I create nonce as
$nonce = wp_create_nonce("action");
And then send the email with nonce to user. In the email there is the link to a page. In the page I form the nonce the same way and try to ...
1
vote
0answers
477 views
wp_create_nonce() in REST API makes user->ID zero
I have trouble with wp_create_nonce() and wp_verify_nonce().
The root of my problem is both the way nonces are created and the place where I generate nonces.
Looking at the codes of wp_create_nonce()...
0
votes
1answer
164 views
check_admin_referer not working in custom meta box for custom post type
In my callback function (the one which output HTML for forms) of add_meta_box, I am using
wp_nonce_field( 'uniqueid', 'my_nonce' )
Now in saving function, I am using this at top to verify nonce
...
1
vote
0answers
237 views
Encountering “Wrong nonce. Action prohibitied.” when trying to alter User Role and unable to Post via WP Admin
The plugin in question that I believe is displaying this message is the User Role Editor, although I do not believe it is causing the issue as users who should have permissions to make posts on the ...
4
votes
2answers
5k views
How do I create a user using the new JSON api in 4.7?
I formerly had the JSON API and JSON USER API plugins working before 4.7 and I have seen the documentation at the ReST API User reference, https://developer.wordpress.org/rest-api/reference/users/#...
3
votes
1answer
767 views
wp_verify_nonce() via REST always returns false
I'm trying to create and verify nonce, and I did it almost the same way as described in wp_create_nonce.
I believe it's related to REST api, but not sure where to investigate?
How I create nonce:
(...
2
votes
1answer
61 views
Nonce failing in IE
I have a strange issue that seems to affect IE but not Chrome (I haven't tried any other browsers)
I'm generating a form with a nonce using the following code -
<?php wp_nonce_field('solution-reg'...
1
vote
2answers
351 views
How do I check if AJAX nonces are implemented correctly?
I have a simple "favorite post" button that works with AJAX. I understand that using a WordPress nonce improves security, but am not quite sure why or how it does this. This also makes me unable to ...
0
votes
1answer
44 views
Does this code indicate an exploit?
I have just started seeing this code on a single Page on our site. This Page is assigned as the static home page for the site.
<input name="_wp_http_referer" value="/" type="hidden">
<input ...
0
votes
2answers
367 views
Why save_post_$(custom_post_type) is fired even if I am not already saving a post?
I'm registering a custom post type named Datasheet. When registering it, I register the callback for meta boxes
'register_meta_box_cb' => [ $this, "add_metaboxes" ]
This is my callback
function ...
2
votes
1answer
312 views
Should nonce be sanitized?
The general guideline is that we should sanitize all user input before using them.
Now my questions is whether this applies to nonce or not.
Which one is correct?
wp_verify_nonce( ...
