Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nonce]

The tag has no usage guidance.

0
votes
0answers
15 views

wp_verfy_nonce keeps giving false

i have a form somthing like this <form id="sample_docs" method="post" action="<?php echo admin_url('admin-ajax.php'); ?>"> <?php wp_nonce_field('nonce_action_sample_docs', '...
1
vote
1answer
15 views

Can a wp_nonce created from domain 1 to be verified on domain 2?

From the Domain 1 i want to make an AJAX request to Domain 2. I would like to create a wp_nonce on Domain 1 and send it with AJAX request to Domain 2, then verify it on Domain 2. The 2 domains are ...
0
votes
1answer
716 views

Maximum lifetime for nonce

In our project we allow users to buy a coupon ( WooCommerce product ) for some service. We save every coupon as a custom post type with all the customer data inserted during purchase. We then via ...
2
votes
1answer
656 views

Why does Wordpress Heartbeat login not refresh the nonces?

Here's an interesting experiment: Go to wordpress plugins listing page, notice the activate, deactivate links all have a nonce part in the request. In a second tab, log out of the site, and go back ...
0
votes
0answers
16 views

Nonce - reissue with ajax poll

I have a plugin which displays a map with markers. Using SetInterval I am refreshing the markers at a pre-determined interval using an ajax call. It is only reading data, no updates. I am using a ...
1
vote
1answer
419 views

Can you have more than one nonce on a page?

I have a site with a page where there's one form in the sidebar, and one in the main body of the page. The sidebar comes first in the HTML. Both forms have their own nonces (generated with ...
0
votes
1answer
40 views

Handling nonces for actions from guests to logged-in users

Imagine the following scenario: John has an account on my website, but is currently not logged in. He clicks the "upvote" button on an article, but is redirected to the login page because only logged-...
1
vote
1answer
597 views

wp_create_nonce() in REST API makes user->ID zero

I have trouble with wp_create_nonce() and wp_verify_nonce(). The root of my problem is both the way nonces are created and the place where I generate nonces. Looking at the codes of wp_create_nonce()...
0
votes
1answer
391 views

custom metabox nonce verification fails

I'm adding a metabox on a custom post type and my nonce-verification fails. I'm not really where to look for why it's going wrong. Can anyone point me in the right direction? Here's my code: function ...
1
vote
0answers
13 views

Why ajax doesn't work on certain wordpress hooks and reload the page instead?

I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
0answers
22 views

Why ajax doesn't work on certain wordpress hooks?

I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
1answer
102 views

“The link you followed has expired” when previewing a post

Recently, I believe after switching to WP 5, non admin users are randomly getting the following error when previewing a post: “The link you followed has expired” . Please try again I am suspecting ...
0
votes
2answers
61 views

Serving nonces through AJAX is not refreshing nonce, returning 403 error

I have run into an issue with nonces becoming invalid, and being unable to refresh to a new nonce. In my example I have a Facebook Connect button, and a Facebook Disconnect button, each with their own ...
0
votes
1answer
20 views

How to check nonce lifetime value of plugins?

Dear StackExchange users, I currently use the premium version of WP Fastest Cache Premium. My website loads very fast, but I always get a 403 error for wp-admin/ajax. I believe there is a plugin ...
3
votes
2answers
6k views

How do I create a user using the new JSON api in 4.7?

I formerly had the JSON API and JSON USER API plugins working before 4.7 and I have seen the documentation at the ReST API User reference, https://developer.wordpress.org/rest-api/reference/users/#...
2
votes
1answer
501 views

Verify nonce in REST API?

I would like to understand the best practices regarding nonce validation in REST APIs. I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
0
votes
0answers
33 views

wp_nonce_url generating invalid links

My goal is to allow users to delete posts they own from the front end. I have an API that returns some JSON along with a link to delete their post. $delLink = wp_nonce_url( site_url() . "/wp-admin/...
3
votes
0answers
238 views

WordPress REST API call generates nonce twice on every call

I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
0
votes
1answer
21 views

Re-use Nonce in Repeating Event Signup Buttons

My understanding is that wordpress nonces (not exactly a "number used once") prevent cross-origin request forgery and last 12 hours. I'm displaying a schedule of classes with a registration button ...
5
votes
4answers
10k views

How to use nonce with front end submission form?

Thanks to a variety of posts on here I've managed to put together a front end submission form. After about 24 hours of tweaking I've finally got everything working including a redirect to a 'success' ...
1
vote
1answer
265 views

WP Admin AJAX Security - using POST to include a relative URL

I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's. The only "real" difference between these scripts ...
3
votes
0answers
534 views

WordPress “Link has expired” error on updating posts

I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
0
votes
1answer
63 views

Override plugin function to show invoices even if not logged in

I am using WooCommerce Print Invoice plugin to print invoices. Now I am working on a Cordova app for my website and I need to be able to see invoices from wordpress. Plugin has a function to hide or ...
0
votes
0answers
21 views

Undefined Index: post_type error on Adding New Page due to nonce

It apparently seem like a duplicate question (Undefined 'post_type' error on Add new page), I've tried solving since a last few hours along with researching and now it's time to ask from ...
1
vote
1answer
32 views

Confusion regarding Nonce & using it in Custom Columns for Saving Checkbox Value to Post Meta

I believe there are multiple ways to use nonce. Recently I've used wp_nonce_field('any_nonce_value'); which creates a <input type="hidden" id="_wpnonce" name="_wpnonce" value="111bc61eba"> ...
1
vote
0answers
56 views

Wordpress password reset - why post rp_key?

I'm developing a plugin and after reading through wp-login.php, I can't seem to work out why some things are done the way they are. Why does WordPress hide the reset password key from the URL? After ...
0
votes
0answers
44 views

How can I verify WordPress nonce from the following code?

<?php /** * Template Name: Manage Days */ if ( isset($_GET['remove_date']) && isset($_GET['_wpnonce']) ) { $delete_date = $_GET['remove_date']; $delete_nonce = $_GET['_wpnonce']; ...
2
votes
1answer
906 views

wp_verify_nonce() via REST always returns false

I'm trying to create and verify nonce, and I did it almost the same way as described in wp_create_nonce. I believe it's related to REST api, but not sure where to investigate? How I create nonce: (...
3
votes
1answer
2k views

Getting “The link you followed has expired” when adding custom post [closed]

EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, ...
10
votes
2answers
11k views

How to get a unique nonce for each Ajax request?

I've seen a couple of discussions about getting Wordpress to regenerate a unique nonce for subsequent Ajax requests, but for the life of me I can't actually get Wordpress to do it-- every time I ...
0
votes
1answer
252 views

Nonce fail after second submit attempt

I am refactoring my plugin that resets the WordPress database tables back to their defaults and came across an issue. The form submission itself works fine. However, after the first submit, and if ...
1
vote
1answer
203 views

Rest API invalid nonce with Backbone Client

I'm using the built-in Backbone Client whenever I try to make a request it gives me this error: {"code":"rest_cookie_invalid_nonce","message":"Cookie nonce is invalid","data":{"status":403}} I read ...
0
votes
0answers
782 views

AJAX form not working, still reloads on submit

I've built a like and unlike system for users, and it works amazingly. The only problem is the page reloads, therefore, I've tried to set up AJAX to submit the form without a page refresh. However, it'...
4
votes
1answer
3k views

WordPress failure when logging out

I have came across the WordPress logout error several times but I really never figured out the cause of it. In earlier days, it was generally that I was missing a nonce but now even with logout link ...
0
votes
0answers
42 views

Passing nonce at admin menu link

I'm trying to pass a nonce at the links created from my plugin using add_menu_page and add_submenu_page. Of course this is invalid: add_submenu_page( 'my_dashboard', 'Dashboard', 'Dashboard', '...
0
votes
1answer
34 views

phpcs error in WordPress

I'm working with the MegaMenu here echo wp_nonce_url() is showing an error All output should run through an escaping function according to wpcs. I gave echo esc_url( wp_nonce_url()) Is it correct? ...
0
votes
1answer
31 views

How to verify nonces in bulk?

Hey I'm relatively new to WP, and I'm trying to get a handle on nonces since they're a good security check. I'm having difficulty verifying my nonces in save_post however. The checks fail on the $...
0
votes
0answers
339 views

Are nonces in WP REST API optional by default?

I'm switching my code from using wp-ajax to the REST API and got puzzled regarding the nonces. First of all, I find it weird that you have to use wp_rest only, since API has many different methods and ...
1
vote
0answers
306 views

Full page NGINX (or Cloudflare) caching and WordPress nonces

Goal: I want to cache the full WordPress response via NGINX and exclusively use the REST API for the user specific parts. Issue: I can't get an authenticated nonce to use against the API. My plan ...
1
vote
1answer
235 views

Custom login doesn't work properly

I've a made a plugin which generates a login form, by using a shortcode. The login works, however, inside the dashboard I've noticed that the forms submits don't work properly. For example, the ...
5
votes
2answers
781 views

How do WordPress Nonces Work?

I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
0
votes
0answers
273 views

CSRF attack to create USER

I'm looking for to fix the issue below : The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress: The attacker sends malicious html page to an ...
1
vote
2answers
296 views

Why am I getting a 403 from check_admin_referer()?

I've written a class to play about with ajax. I had originally used check_admin_referer (in hello()) without arguments but got this warning: "PHP Notice: check_admin_referer was called incorrectly. ...
9
votes
3answers
3k views

Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script

For those that arrive from Google: You probably shouldn't get the nonces from the REST API, unless you really know what you're doing. Cookie-based authentication with the REST API is only meant for ...
1
vote
3answers
2k views

wp_verify_nonce doesn't return true on server when it matches the nonce

$.ajax({ type: "POST", dataType: "text", url: ajaxurl, data: { action: "more_news", nonce: nonce, offset: offset }, success : function(data, ...
0
votes
1answer
246 views

Register rest field authentication with REST API

I'm trying to add some user meta information to the existing wp/v2/users REST endpoint. However, it looks like additional authentication is required, i.e. I get this (output in comments): ...
1
vote
1answer
207 views

increase nonce lifespan

I want to increase the nonce lifespan from the default 12-24h, to 36-48h. I found the following code in the codex, but don't know where to put it. add_filter( 'nonce_life', function () { return ...
1
vote
1answer
336 views

Handling expired nonces

I have a page with a few buttons. When people click on the buttons they issue AJAX requests and update various parts of the page. The AJAX requests make use of nonces for security purposes. I ...
3
votes
1answer
1k views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
1k views

wp_nonce_url to users.php for deleting user not working

Using wpjobmanager plugin for my site gojobr.com.au : I've encountered a problem: to combat spam users that keep posting the same spammy jobs (they are doing so manually so no a captcha won't solve ...