Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nonce]

The tag has no usage guidance.

20
votes
2answers
7k views

wp_verify_nonce vs check_admin_referer

What is the difference, which one should I use? I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
15
votes
4answers
6k views

Do I need a nonce field for every meta box I add to my custom post type admin?

I'm currently working on the admin page of my custom post type, and I got stuck on deciding whether to add a nonce field again for the second metabox or not. I'm very new to custom post types, and ...
12
votes
2answers
3k views

Can I use the same nonce for multiple requests on the same page?

Or does this break the purpose of the nonce, which I admint I don't quite understand it? :) For example on two ajax requests that run on page load, or when something is clicked: $.ajax({ type: '...
12
votes
1answer
3k views

How does nonce verification work?

I can see that wp_nonce_field generates a value in the hidden field. <input type="hidden" id="message-send" name="message-send" value="cabfd9e42d" /> But wp_verify_nonce isn't using that ...
10
votes
2answers
1k views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
10
votes
2answers
11k views

How to get a unique nonce for each Ajax request?

I've seen a couple of discussions about getting Wordpress to regenerate a unique nonce for subsequent Ajax requests, but for the life of me I can't actually get Wordpress to do it-- every time I ...
9
votes
3answers
3k views

Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script

For those that arrive from Google: You probably shouldn't get the nonces from the REST API, unless you really know what you're doing. Cookie-based authentication with the REST API is only meant for ...
7
votes
1answer
1k views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
6
votes
1answer
1k views

Extend Wordpress (4.x) session and nonce

We've got a small web application that allows users to log in (via WordPress) and remain logged in for a max 15 min session for security purposes. Because most sessions will last longer, I have a ...
5
votes
2answers
768 views

How do WordPress Nonces Work?

I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
5
votes
1answer
4k views

How to expire a nonce?

I am aware of the fact that we can alter nonce life time using filter , 30 seconds here: add_filter( 'nonce_life', function () { return 30; } ); I have a logout() function for my rest api .I wish to ...
5
votes
2answers
336 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
5
votes
4answers
10k views

How to use nonce with front end submission form?

Thanks to a variety of posts on here I've managed to put together a front end submission form. After about 24 hours of tweaking I've finally got everything working including a redirect to a 'success' ...
5
votes
1answer
2k views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
4
votes
1answer
3k views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
4
votes
2answers
6k views

How do I create a user using the new JSON api in 4.7?

I formerly had the JSON API and JSON USER API plugins working before 4.7 and I have seen the documentation at the ReST API User reference, https://developer.wordpress.org/rest-api/reference/users/#...
4
votes
1answer
532 views

Do I require the use of nonce?

Im creating a visit/page views counter with ajax,jquery and php, I have been reading a few articles that recommend the use of nonces for data manipulation through ajax, however i am not sure if i need ...
4
votes
1answer
93 views

Can I verify nonce which was generated on a different WP site?

I have a form with the action going to a different wordpress site. I want to use wp_nonce to generate fields in the form on site A. Can I use wp_verify_nonce on site B to verify the nonce fields?
4
votes
1answer
2k views

WordPress failure when logging out

I have came across the WordPress logout error several times but I really never figured out the cause of it. In earlier days, it was generally that I was missing a nonce but now even with logout link ...
3
votes
1answer
6k views

Fatal error: Call to undefined function wp_create_nonce()

I'm trying to add a nonce to my plugin's Ajax. I'm not sure why I'm getting this error: Fatal error: Call to undefined function wp_create_nonce() In my php file : wp_localize_script('my-ajax-...
3
votes
2answers
6k views

AJAX nonce with check_ajax_referer()

I want to use check_ajax_referer() to verify a WP_nonce field using AJAX. Here you can find my html element. <input type="hidden" name="login_nonce" value="<?= wp_create_nonce('login_nonce'); ?...
3
votes
1answer
3k views

How to add/retrieve the post trash link?

I am creating a plugin to display all posts from all custom post type. It is something like in edit.php, but instead of displaying single post type, I would like to display all posts in one page from ...
3
votes
1answer
2k views

Getting “The link you followed has expired” when adding custom post [closed]

EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, ...
3
votes
1answer
714 views

Using nonce external of WP Admin

All, I've got two wordpress pages. One wordpress page displays a form to do some registration stuff for the website. The second wordpress page actually processes the data and inserts it into a custom ...
3
votes
1answer
282 views

How to add Wordpress nonces to ajax request

I have a plugin, a cron job runs refresh_my_plugin() daily. I need a button on my plugins Settings/option page, allowing a user to manually run said function, and I want it inline, with ajax. I've ...
3
votes
2answers
593 views

Nonce best practices: hidden input vs. wp_localize_script?

I noticed while looking at the HTML of an edit page that WordPress uses a lot of hidden input elements for storing nonces. Is there a significant advantage to using either this style of storing ...
3
votes
1answer
878 views

wp_verify_nonce() via REST always returns false

I'm trying to create and verify nonce, and I did it almost the same way as described in wp_create_nonce. I believe it's related to REST api, but not sure where to investigate? How I create nonce: (...
3
votes
0answers
217 views

WordPress REST API call generates nonce twice on every call

I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
3
votes
0answers
476 views

WordPress “Link has expired” error on updating posts

I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
3
votes
1answer
1k views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
2
votes
2answers
1k views

How to verify nonce from Bulk/Quick Edit in save_post?

I need to do something specific in my save_post callback for bulk and/or quick edits, so how do I check the nonce for that? I can only find _wpnonce in the edit.php html source, but can't find an ...
2
votes
1answer
720 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
2
votes
1answer
381 views

Should nonce be sanitized?

The general guideline is that we should sanitize all user input before using them. Now my questions is whether this applies to nonce or not. Which one is correct? wp_verify_nonce( ...
2
votes
1answer
4k views

How to stop _wpnonce and _wp_http_referer from appearing in URL

I am trying to develop a plug-in that has a search field and uses WP_List_Table. The plug-in is strictly for the backend and searches the users in the database and returns them along with some other ...
2
votes
1answer
74 views

Nonce failing in IE

I have a strange issue that seems to affect IE but not Chrome (I haven't tried any other browsers) I'm generating a form with a nonce using the following code - <?php wp_nonce_field('solution-reg'...
2
votes
1answer
460 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
2
votes
1answer
262 views

How to save multiple metaboxes?

I read a tutorial about metaboxes, most of things are clear but I have a question about multiple metaboxes. My question is about saving, in the tutorial: <?php add_action( 'save_post', '...
2
votes
1answer
582 views

Using nonce in menu item

I have a log out link in the main header menu, when you click on the link to log out, you are redirected to the page asking if you really want to log out. I know it's doing this because there is no ...
2
votes
1answer
24 views

Nonce actions and names available via open source

I am using a plugin which makes its code publicly available. Therefore, anyone can see the $action and $name parameters used to generate the nonces. Does this make my site more vulnerable since ...
2
votes
2answers
2k views

AJAX requests broken due to HTTPS for wp-admin

I have my wp-admin section forced to HTTPS via a plugin. I also have specific pages that are using https on the frontend (login, billing, etc.) I seem to be having an issue with HTTP pages using AJAX ...
2
votes
1answer
92 views

Using Nonces for AJAX that only retrieves data

Does it make sense to use a nonce on an AJAX action that only returns data and doesn't alter data on the server side? I understand they are important if you are saving data or changing something on ...
2
votes
1answer
4k views

How to get the wpnonce value?

On using inspect element to check the 'href' attribute of 'Deactivate' links for the plugins listed on plugins.php page, I found that the url contains a wpnonce field with a certain value. I need to ...
2
votes
0answers
2k views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
1
vote
2answers
3k views

wp_verify_nonce always returns false when logged in as admin

I've implemented some AJAX functionality for my plugin and it works fine as long as I'm not logged in as admin - then wp_verify_nonce fails. It works for unauthorized users and authorized regular ...
1
vote
1answer
696 views

Verify Nonce returns false - Request Nonce returns correct value

I'm trying to verify that the nonce I created exists but for some reason it keeps returning false, why is this happening? Creating my nonce: <?php wp_nonce_field('test_slider_action','...
1
vote
2answers
4k views

Undefined index: at_nonce in custom post metabox

I'm getting this error with my custom post metabox. The custom post and metabox works fine, but if i have debug on and when i try to save any other page or post, i will get an error: Notice: ...
1
vote
1answer
336 views

What SQL / WordPress queries would need a nonce?

I'm a PHP / JavaScript developer and I'm new to WordPress. Our company's website is build upon WordPress. However I created many custom PHP pages without minding the WordPress framework much. When ...
1
vote
2answers
220 views

my theme breaks WP export

I know this is a vague question, please just spend time on it if you are in the mood, I don't need to be flamed for not being more precise. I'm having a problem with a theme I'm developing, for some ...
1
vote
2answers
273 views

Why am I getting a 403 from check_admin_referer()?

I've written a class to play about with ajax. I had originally used check_admin_referer (in hello()) without arguments but got this warning: "PHP Notice: check_admin_referer was called incorrectly. ...
1
vote
1answer
360 views

How can I trash multiple posts at once from the front end?

I took a peek at the code in edit.php and am now generating links with this code: wp_nonce_url("/wp-admin/edit.php?doaction=trash&amp;post_type=post&amp;ids=postIds", "bulk-posts") The ...