Questions tagged [nonce]
The nonce tag has no usage guidance.
200
questions
1
vote
1answer
54 views
wp_verify_nonce return false despite correct parameter passed
I have created a form that have nonce
<form action="<?php echo get_rest_url(null, 'ilms_plugin/new_membership') ?>" method="post" class=' space-y-2 mt-2 p-2 rounded-md '&...
0
votes
0answers
7 views
Email 'Magic Link' to Access Content (not login)
I'm developing a site where users have their own 'profile' pages but which won't be public. I have a redirect in place currently which sends the visiting user away if not logged in (and not the owner)....
0
votes
2answers
91 views
Log out without confirmation request (nonce)
I have a Wordpress site with WooCommerce. I would like to add a Logout option to the Menu that logs out the user without asking for confirmation.
So I included a menu custom link with as URL: /my-...
0
votes
1answer
48 views
Extend Nonce Lifetime for Specific Nonce Creation
I've got as far as successfully filtering the global nonce_life but am running into trouble applying the filter in a specific function in the way described in this answer.
function ...
0
votes
1answer
83 views
wp_nonce vs jwt
I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend.
What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
0
votes
1answer
136 views
Why does check_ajax_referer give a 403 error on https websites?
When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended.
But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
1
vote
1answer
25 views
Nonce failing on form submission
I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1answer
48 views
SSO autologin Wordpress + Ajax
That one keeps me awake at night.
The problem is that the user is properly logging in, but AFTER page refresh and should be immediately logged in without page reload. Need a fresh eyes to look at it.
...
1
vote
1answer
33 views
how to send Ajax request in wordpress backend
On the fronted the wp_localize_script seems to be working as when I view the source I can see the nonce.
wp_localize_script('scripts', 'myAjax', array(
'root_url' => get_site_url(),
'...
2
votes
0answers
107 views
Nonces, AJAX, script variables & security in WordPress
Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using:
wp_enqueue_script(
'script_handle',
PATH_TO_SCRIPT,
array(),
'1.0.0',
true
);
...
1
vote
1answer
270 views
permission_callback has no effect
WP version is 5.5.3
I have 3 API routes set in a plugin that is used in an admin dashboard page. One route is meant to be used "publicly".
I have two very curious issues happening:
My 3 ...
0
votes
0answers
23 views
Wordpress nonce failed sometime
I have generated the nonce key in the HTML form using the following function - wp_nonce_field('test_form_action', 'test_form_field'); and posted all the form data along with nonce value to server side ...
0
votes
1answer
71 views
CSP nonces with Cloudflare Workers
Like this blog, I use Cloudflare Workers to inject CSP (Content Security Policy) nonce in headers : https://scotthelme.co.uk/csp-nonces-the-easy-way-with-cloudflare-workers/
This is functional.
Next, ...
1
vote
1answer
183 views
Identical wp_rest nonce returned from rest_api
TLDR: How can I force a new nonce to be returned, so that AJAX works without refreshing the page?
Following on from Nonces and Ajax request to REST API and verification I implemented the Nonce ...
2
votes
1answer
380 views
Nonces and Ajax request to REST API and verification
Building my first WordPress in over a decade... using Timber for MVC. Vue on the frontend, and axios for ajax posts. All hosted on the same domain, so I can use cookies for authentication.
I am ...
0
votes
1answer
883 views
Using a nonce Content Security Policy header for style-src for inline style elements returns errors
When using a nonce in a Content Security Policy header, both Google Chrome and Firefox return errors. The nonce value is for a style element i.e. <style id="some-id">// CSS </style&...
1
vote
1answer
610 views
Found 2 elements with non-unique id (#_ajax_nonce) and (#_wpnonce)
I am developing custom theme from scratch and creates a custom post type and getting this warning while editing custom post type. I also design custom Meta box with two input fields and using nonce in ...
0
votes
1answer
42 views
Wordpress JSON API nonces and Vue development server
As stated in the official docs, the JSON API CSRF protection only works from within Wordpress.
It is important to keep in mind that this authentication method relies on WordPress cookies. As a result ...
0
votes
0answers
10 views
Ajax sends me back my home page as a response
Good morning all,
So, I try to do a request with ajax and everything is going fine up to this point:
In the frontend, Ajax sends me my home page as a response when I am logged in as a subscriber, i.e. ...
0
votes
1answer
228 views
WordPress is creating nonce as a logged in user but verifying it incorrectly
I'm having trouble validating a nonce created with wp_create_nonce() inside a hidden input with the name nonce in an html form:
<input type="hidden" name="nonce" value="<...
0
votes
0answers
30 views
WordPress nonces are wrong and not working?
I really don't understand what is happening with WordPress nonces, i think they're wrong, or they're useless.
I always have troubles working with that nonces, WordPess never been able to check one ...
0
votes
1answer
97 views
Change button link to add nonce
I am making a Logout button, but in order for it to work properly the link needs to have the correct nonce ("site.com/wp-login.php?action=logout&wp_nonce=X".
I have found in another ...
0
votes
1answer
68 views
Verify a nonce in Form submission
I am new in using Nonce.I am using Nonce like below in a Form
wp_nonce_field('add_new_addres','add_new_address');
I am trying to verify Nonce like below
if(isset( $_REQUEST['action'] ) &&...
0
votes
0answers
118 views
wp_verify_nonce not working on the mobile device
I am using a very simple form request to and verify it through the wp_verify_nonce() function. It is working perfectly on the desktop. But not working on mobile devices( iPhone, Andriod ). Could ...
0
votes
0answers
58 views
How to use wp_create_nonce() to get user ID in WordPress Rest Api
I know a lot of questions have been asked about this topic but I have had no luck implementing their code. I want to be able to use get_current_user_id() inside my WordPress Rest Api. This is what I ...
0
votes
1answer
695 views
How to not cache nonces with WP Rocket?
We have a system where we pass a nonce from a PHP-script on the server to an AJAX-call running client-side, and then back again to check the validity of the request.
This nonce is cached, and we can'...
0
votes
0answers
28 views
How do I mitigate replay attacks when talking about actions that shouldn't happen twice?
A nonce is supposed to first help me against CSRF and help against replay attacks is just a bonus if I "personalize" the nonce to something like pay-user-{id}, but here's the problem - if my link ...
1
vote
0answers
175 views
Draft preview and customize permission problems on multisite main site
So I've been stuck on this problem for quite a while now and it feels like I've tried everything. I would love for some support here.
Setup
A WordPress multisite with Bedrock structure
PHP 7.3.17 (...
2
votes
1answer
1k views
Can't GET draft posts via REST API from headless frontend
I have a headless install of Wordpress on v5.4.0. The frontend can't GET any post that is in draft status, though when accessing the API url directly the data is returned without an issue. I'm ...
1
vote
1answer
844 views
Properly applying nonce to a form using AJAX
So I'm still learning around WordPress and can't seem to figure out how to properly hook a nonce into a AJAX Form that I have created.
Here I am hooking and localizing the js file and defining a ...
0
votes
1answer
110 views
Why are nonces working in Firefox but not in Chrome?
I created the nonce when I localize a script file:
wp_localize_script('cad-search', 'cad_ajax',
array( 'ajaxurl' => admin_url( 'admin-ajax.php' ),
'nonce'=> wp_create_nonce('...
0
votes
1answer
142 views
Backbone with custom rest endpoints
I have created a custom endpoint that returns select user meta data. I am trying to access this endpoint with Backbone. It works as expected in Postman and from my Backbone/javascript script If I have ...
0
votes
1answer
133 views
Is it safe to use a global wp nonce per user instead of a nonce per action?
Please refer to my comments on Greg's answer for more details in relation to his answer which are also relevant to this.
I'm routing all my AJAX requests through a Controller, this is a class that ...
1
vote
0answers
229 views
x-wp-nonce across domains
I've installed WPML with a multiple domain configuration (one domain per language).
The wrong thing is that, when editing for example a post while using a different domain from the main, it just ...
0
votes
0answers
42 views
whether a nonce is required for get type and get_query_var?
I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not.
I use the get_query_var method to modify the main query. It uses a get method.
whether a nonce is ...
0
votes
0answers
37 views
Unable to update plugins or log out
The server my site was hosted on recently went down and someone else was able to fix it for me. I am unclear on what exactly the issues with the server were, but since the site came back up, my cron ...
1
vote
0answers
41 views
Is nonce in PHP form and Ajax both necessary?
I have a php form which is submitted through jQuery Ajax. Previously i had used nonce with Ajax and PHP form seperately.
Here i am using wp_nonce_field() in PHP form. Is it necessary to use ...
2
votes
1answer
103 views
When is it useful to use wp_verify_nonce
I know that wp_verify_nonce() is used to make sure that the $_POST is coming from a safe place.
I am developing a WordPress plugin which creates custom lists. In order to do that the web site owner ...
2
votes
1answer
1k views
Headless Wordpress: How to authenticate front end requests?
I am envisioning Wordpress on the back end to work with React.js on the front end like this:
Wordpress is installed on http://example.com/api
React.js script is loaded into http://example.com/index....
1
vote
1answer
772 views
Passing a borrowed nonce through Postman fails
I'm trying to test borrowing a nonce from my browser session so that I can use it elsewhere, namely in my npm dev environment.
I took a nonce passed into an open Chrome browser session, put it in a ...
1
vote
1answer
314 views
WP nonce invalid
Have a quick script to search for untranslated pages, and then returning a translate link. (Polylang makes a new post for a translation, which is then linked to the original.)
All is working well, ...
0
votes
1answer
656 views
Rest API: wp_verify_nonce() fails despite receiving correct nonce value
I am generating a nonce to be used with client side fetch requests to the rest api:
function prepAllAdminScripts() {
wp_register_script(
'reactAdminArea'
, PLUGIN_FOLDER_URL . 'shared/...
0
votes
0answers
34 views
Does it make sense to check a nonce on user log in?
I read the following blog post about implementing custom user log in:
http://natko.com/wordpress-ajax-login-without-a-plugin-the-right-way/
In the post, the author walks through some PHP code for ...
1
vote
0answers
303 views
wp_create_nonce doesn't verify when using WP_List_Table
I've created an admin page where I'm displaying a list of a MySQL Table using WP_List_Table.
In this table I need to be able to delete a record when I want to.
And that's where I have a problem.
To ...
0
votes
1answer
61 views
Custom Meta Boxes - Nonce Issue - Move to trash issue
Recently after updating Wordpress from 4.9.2 to 5.2, I have had to change a good bit of code to get my custom post type listings(or posts) to function and save data correctly. Specifically, with the ...
3
votes
2answers
555 views
Nonce in settings API with tabbed navigation
I'm rewording this because, as it's correctly been pointed out, the original post was "woefully inadequate." I made a plugin which has tabbed views for the various settings. It's based on this ...
1
vote
2answers
2k views
Wordpress REST API, Expired Nonce from Cache results in 403 forbidden
My wordpress site sits behind Akamai, which is a cacheing service similar to Cloudflare.
I make the following API call:
GET /wp-json/mytheme/v1/get-posts?post_type=videos
This is done using ...
0
votes
0answers
32 views
wp_verfy_nonce keeps giving false
i have a form somthing like this
<form id="sample_docs" method="post" action="<?php echo admin_url('admin-ajax.php'); ?>">
<?php wp_nonce_field('nonce_action_sample_docs', '...
1
vote
1answer
38 views
Can a wp_nonce created from domain 1 to be verified on domain 2?
From the Domain 1 i want to make an AJAX request to Domain 2.
I would like to create a wp_nonce on Domain 1 and send it with AJAX request to Domain 2, then verify it on Domain 2.
The 2 domains are ...
0
votes
0answers
28 views
Nonce - reissue with ajax poll
I have a plugin which displays a map with markers. Using SetInterval I am refreshing the markers at a pre-determined interval using an ajax call.
It is only reading data, no updates.
I am using a ...
