Questions tagged [nonce]
The nonce tag has no usage guidance.
0
votes
1answer
27 views
Handling nonces for actions from guests to logged-in users
Imagine the following scenario:
John has an account on my website, but is currently not logged in.
He clicks the "upvote" button on an article, but is redirected to the login page because only logged-...
1
vote
0answers
13 views
Why ajax doesn't work on certain wordpress hooks and reload the page instead?
I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
0answers
16 views
Why ajax doesn't work on certain wordpress hooks?
I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
1answer
48 views
“The link you followed has expired” when previewing a post
Recently, I believe after switching to WP 5, non admin users are randomly getting the following error when previewing a post:
“The link you followed has expired” . Please try again
I am suspecting ...
0
votes
2answers
31 views
Serving nonces through AJAX is not refreshing nonce, returning 403 error
I have run into an issue with nonces becoming invalid, and being unable to refresh to a new nonce. In my example I have a Facebook Connect button, and a Facebook Disconnect button, each with their own ...
0
votes
1answer
17 views
How to check nonce lifetime value of plugins?
Dear StackExchange users,
I currently use the premium version of WP Fastest Cache Premium. My website loads very fast, but I always get a 403 error for wp-admin/ajax.
I believe there is a plugin ...
0
votes
0answers
26 views
wp_nonce_url generating invalid links
My goal is to allow users to delete posts they own from the front end. I have an API that returns some JSON along with a link to delete their post.
$delLink = wp_nonce_url( site_url() . "/wp-admin/...
0
votes
1answer
260 views
Verify nonce in REST API?
I would like to understand the best practices regarding nonce validation in REST APIs.
I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
3
votes
0answers
176 views
WordPress REST API call generates nonce twice on every call
I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
0
votes
1answer
19 views
Re-use Nonce in Repeating Event Signup Buttons
My understanding is that wordpress nonces (not exactly a "number used once") prevent cross-origin request forgery and last 12 hours.
I'm displaying a schedule of classes with a registration button ...
1
vote
1answer
213 views
WP Admin AJAX Security - using POST to include a relative URL
I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's.
The only "real" difference between these scripts ...
3
votes
0answers
393 views
WordPress “Link has expired” error on updating posts
I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
0
votes
1answer
58 views
Override plugin function to show invoices even if not logged in
I am using WooCommerce Print Invoice plugin to print invoices.
Now I am working on a Cordova app for my website and I need to be able to see invoices from wordpress.
Plugin has a function to hide or ...
0
votes
0answers
17 views
Undefined Index: post_type error on Adding New Page due to nonce
It apparently seem like a duplicate question (Undefined 'post_type' error on Add new page), I've tried solving since a last few hours along with researching and now it's time to ask from ...
1
vote
1answer
30 views
Confusion regarding Nonce & using it in Custom Columns for Saving Checkbox Value to Post Meta
I believe there are multiple ways to use nonce.
Recently I've used wp_nonce_field('any_nonce_value');
which creates a
<input type="hidden" id="_wpnonce" name="_wpnonce" value="111bc61eba">
...
1
vote
0answers
47 views
Wordpress password reset - why post rp_key?
I'm developing a plugin and after reading through wp-login.php, I can't seem to work out why some things are done the way they are.
Why does WordPress hide the reset password key from the URL?
After ...
0
votes
0answers
42 views
How can I verify WordPress nonce from the following code?
<?php
/**
* Template Name: Manage Days
*/
if ( isset($_GET['remove_date']) && isset($_GET['_wpnonce']) ) {
$delete_date = $_GET['remove_date'];
$delete_nonce = $_GET['_wpnonce'];
...
0
votes
1answer
154 views
Rest API invalid nonce with Backbone Client
I'm using the built-in Backbone Client whenever I try to make a request it gives me this error: {"code":"rest_cookie_invalid_nonce","message":"Cookie nonce is invalid","data":{"status":403}}
I read ...
0
votes
0answers
676 views
AJAX form not working, still reloads on submit
I've built a like and unlike system for users, and it works amazingly. The only problem is the page reloads, therefore, I've tried to set up AJAX to submit the form without a page refresh. However, it'...
0
votes
0answers
33 views
Passing nonce at admin menu link
I'm trying to pass a nonce at the links created from my plugin using add_menu_page and add_submenu_page.
Of course this is invalid:
add_submenu_page(
'my_dashboard',
'Dashboard',
'Dashboard',
'...
0
votes
1answer
33 views
phpcs error in WordPress
I'm working with the MegaMenu here echo wp_nonce_url() is showing an error All output should run through an escaping function according to wpcs. I gave echo esc_url( wp_nonce_url()) Is it correct? ...
0
votes
1answer
29 views
How to verify nonces in bulk?
Hey I'm relatively new to WP, and I'm trying to get a handle on nonces since they're a good security check. I'm having difficulty verifying my nonces in save_post however.
The checks fail on the $...
0
votes
0answers
280 views
Are nonces in WP REST API optional by default?
I'm switching my code from using wp-ajax to the REST API and got puzzled regarding the nonces. First of all, I find it weird that you have to use wp_rest only, since API has many different methods and ...
0
votes
0answers
192 views
Set nonces correctly for a JSON REST API v2 (WP 4.8.5)
I'm using Gravity Forms, and I want to use a jQuery script to set some defaults in my form. Whenever the user dropdown changes, fetch all the roles belonging to the chosen user. I thought the simplest ...
3
votes
1answer
2k views
Getting “The link you followed has expired” when adding custom post [closed]
EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, ...
1
vote
0answers
293 views
Full page NGINX (or Cloudflare) caching and WordPress nonces
Goal: I want to cache the full WordPress response via NGINX and exclusively use the REST API for the user specific parts.
Issue: I can't get an authenticated nonce to use against the API.
My plan ...
1
vote
1answer
235 views
Custom login doesn't work properly
I've a made a plugin which generates a login form, by using a shortcode. The login works, however, inside the dashboard I've noticed that the forms submits don't work properly. For example, the ...
5
votes
2answers
753 views
How do WordPress Nonces Work?
I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
0
votes
0answers
243 views
CSRF attack to create USER
I'm looking for to fix the issue below :
The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress:
The attacker sends malicious html page to an ...
1
vote
2answers
253 views
Why am I getting a 403 from check_admin_referer()?
I've written a class to play about with ajax. I had originally used check_admin_referer (in hello()) without arguments but got this warning: "PHP Notice: check_admin_referer was called incorrectly. ...
8
votes
3answers
3k views
Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script
For those that arrive from Google: You probably shouldn't get the nonces from the REST API, unless you really know what you're doing. Cookie-based authentication with the REST API is only meant for ...
0
votes
1answer
228 views
Register rest field authentication with REST API
I'm trying to add some user meta information to the existing wp/v2/users REST endpoint. However, it looks like additional authentication is required, i.e. I get this (output in comments):
...
1
vote
1answer
170 views
increase nonce lifespan
I want to increase the nonce lifespan from the default 12-24h, to 36-48h.
I found the following code in the codex, but don't know where to put it.
add_filter( 'nonce_life', function () { return ...
1
vote
1answer
297 views
Handling expired nonces
I have a page with a few buttons. When people click on the buttons they issue AJAX requests and update various parts of the page. The AJAX requests make use of nonces for security purposes.
I ...
3
votes
1answer
258 views
How to add Wordpress nonces to ajax request
I have a plugin, a cron job runs refresh_my_plugin() daily.
I need a button on my plugins Settings/option page, allowing a user to manually run said function, and I want it inline, with ajax.
I've ...
0
votes
1answer
78 views
Stop WordPress nonces expiring
I would like to have nonce key forever, i don't want to change or refresh. Any idea?
add_filter( 'nonce_life', function () { return 4 * 1000000000000000000; } );
0
votes
1answer
258 views
Unable to successfully verify nonce
I'm developing a plugin (for the first time) and I'm trying to be responsible and include a nonce in my Ajax call. I've looked at a dozen tutorials, all with different approaches, and I thought I had ...
0
votes
2answers
150 views
javascript ajax and nonce
I am struggling to implement nonces through XML request to php backend using the Wordpress nonce validation when creating forms dynamically. I am ok with the form built version
wp_nonce_field( '...
0
votes
1answer
388 views
How to add a WordPress Nonce for this form to avoid CSRF
Here is the Form and I would like to add a WordPress nonce to it:
<form action="" method="post">
<label>Enter your email address:</label> <input id="email" ...
0
votes
2answers
244 views
When must I use and verify nonce?
I'm developing a WordPress site which posts a number of ajax calls from jquery to PHP and returns data from PHP to jquery.
I need to know when must I use and verify nonce?
0
votes
1answer
184 views
Reduce nonce lifespan
for a personal plugin (nothing going to the public or commercial), I built an AJAX form and its endpoint is a custom endpoint (REST Api).
When a certain Page containing my form is accessed, I ...
1
vote
2answers
2k views
WP REST API - Nonce passes wp_verify_nonce even after logout
I'm creating a single page app with WP REST API and AngularJS. After solving a problem with nonces on this question, now i'm facing something else.
To test the chance of adding fields and making them ...
0
votes
1answer
3k views
WP REST API: check if user is logged in
The idea is to show or hide some sections of the site in a theme that's fetching all data from the REST API, using AngularJS.
I thought this check would help me (nonce is passed as header, as ...
2
votes
1answer
554 views
Using nonce in menu item
I have a log out link in the main header menu, when you click on the link to log out, you are redirected to the page asking if you really want to log out. I know it's doing this because there is no ...
0
votes
1answer
156 views
Cannot verify nonce
I create nonce as
$nonce = wp_create_nonce("action");
And then send the email with nonce to user. In the email there is the link to a page. In the page I form the nonce the same way and try to ...
1
vote
1answer
533 views
wp_create_nonce() in REST API makes user->ID zero
I have trouble with wp_create_nonce() and wp_verify_nonce().
The root of my problem is both the way nonces are created and the place where I generate nonces.
Looking at the codes of wp_create_nonce()...
0
votes
1answer
196 views
check_admin_referer not working in custom meta box for custom post type
In my callback function (the one which output HTML for forms) of add_meta_box, I am using
wp_nonce_field( 'uniqueid', 'my_nonce' )
Now in saving function, I am using this at top to verify nonce
...
1
vote
0answers
276 views
Encountering “Wrong nonce. Action prohibitied.” when trying to alter User Role and unable to Post via WP Admin
The plugin in question that I believe is displaying this message is the User Role Editor, although I do not believe it is causing the issue as users who should have permissions to make posts on the ...
4
votes
2answers
6k views
How do I create a user using the new JSON api in 4.7?
I formerly had the JSON API and JSON USER API plugins working before 4.7 and I have seen the documentation at the ReST API User reference, https://developer.wordpress.org/rest-api/reference/users/#...
3
votes
1answer
849 views
wp_verify_nonce() via REST always returns false
I'm trying to create and verify nonce, and I did it almost the same way as described in wp_create_nonce.
I believe it's related to REST api, but not sure where to investigate?
How I create nonce:
(...
