Questions tagged [nonce]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
20
votes
2answers
7k views

wp_verify_nonce vs check_admin_referer

What is the difference, which one should I use? I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
15
votes
4answers
6k views

Do I need a nonce field for every meta box I add to my custom post type admin?

I'm currently working on the admin page of my custom post type, and I got stuck on deciding whether to add a nonce field again for the second metabox or not. I'm very new to custom post types, and ...
12
votes
1answer
4k views

How does nonce verification work?

I can see that wp_nonce_field generates a value in the hidden field. <input type="hidden" id="message-send" name="message-send" value="cabfd9e42d" /> But wp_verify_nonce isn't using that ...
12
votes
2answers
3k views

Can I use the same nonce for multiple requests on the same page?

Or does this break the purpose of the nonce, which I admint I don't quite understand it? :) For example on two ajax requests that run on page load, or when something is clicked: $.ajax({ type: '...
10
votes
2answers
1k views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
10
votes
2answers
11k views

How to get a unique nonce for each Ajax request?

I've seen a couple of discussions about getting Wordpress to regenerate a unique nonce for subsequent Ajax requests, but for the life of me I can't actually get Wordpress to do it-- every time I ...
9
votes
3answers
3k views

Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script

For those that arrive from Google: You probably shouldn't get the nonces from the REST API, unless you really know what you're doing. Cookie-based authentication with the REST API is only meant for ...
7
votes
1answer
1k views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
6
votes
1answer
1k views

Extend Wordpress (4.x) session and nonce

We've got a small web application that allows users to log in (via WordPress) and remain logged in for a max 15 min session for security purposes. Because most sessions will last longer, I have a ...
5
votes
2answers
787 views

How do WordPress Nonces Work?

I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
5
votes
1answer
4k views

How to expire a nonce?

I am aware of the fact that we can alter nonce life time using filter , 30 seconds here: add_filter( 'nonce_life', function () { return 30; } ); I have a logout() function for my rest api .I wish to ...
5
votes
2answers
342 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
5
votes
4answers
11k views

How to use nonce with front end submission form?

Thanks to a variety of posts on here I've managed to put together a front end submission form. After about 24 hours of tweaking I've finally got everything working including a redirect to a 'success' ...
5
votes
1answer
2k views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
4
votes
1answer
3k views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
4
votes
2answers
6k views

AJAX nonce with check_ajax_referer()

I want to use check_ajax_referer() to verify a WP_nonce field using AJAX. Here you can find my html element. <input type="hidden" name="login_nonce" value="<?= wp_create_nonce('login_nonce'); ?...
4
votes
1answer
558 views

Do I require the use of nonce?

Im creating a visit/page views counter with ajax,jquery and php, I have been reading a few articles that recommend the use of nonces for data manipulation through ajax, however i am not sure if i need ...
4
votes
1answer
3k views

WordPress failure when logging out

I have came across the WordPress logout error several times but I really never figured out the cause of it. In earlier days, it was generally that I was missing a nonce but now even with logout link ...
3
votes
2answers
7k views

How do I create a user using the new JSON api in 4.7?

I formerly had the JSON API and JSON USER API plugins working before 4.7 and I have seen the documentation at the ReST API User reference, https://developer.wordpress.org/rest-api/reference/users/#...
3
votes
1answer
6k views

Fatal error: Call to undefined function wp_create_nonce()

I'm trying to add a nonce to my plugin's Ajax. I'm not sure why I'm getting this error: Fatal error: Call to undefined function wp_create_nonce() In my php file : wp_localize_script('my-ajax-...
3
votes
1answer
3k views

How to add/retrieve the post trash link?

I am creating a plugin to display all posts from all custom post type. It is something like in edit.php, but instead of displaying single post type, I would like to display all posts in one page from ...
3
votes
1answer
2k views

Getting “The link you followed has expired” when adding custom post [closed]

EDIT: I have completely rewritten this question because it has been closed as off-topic. In my opinion, it has two very relevant points that could help other developers but, in its original form, ...
3
votes
1answer
720 views

Using nonce external of WP Admin

All, I've got two wordpress pages. One wordpress page displays a form to do some registration stuff for the website. The second wordpress page actually processes the data and inserts it into a custom ...
3
votes
2answers
91 views

Nonce in settings API with tabbed navigation

I'm rewording this because, as it's correctly been pointed out, the original post was "woefully inadequate." I made a plugin which has tabbed views for the various settings. It's based on this ...
3
votes
2answers
593 views

Nonce best practices: hidden input vs. wp_localize_script?

I noticed while looking at the HTML of an edit page that WordPress uses a lot of hidden input elements for storing nonces. Is there a significant advantage to using either this style of storing ...
3
votes
1answer
94 views

Can I verify nonce which was generated on a different WP site?

I have a form with the action going to a different wordpress site. I want to use wp_nonce to generate fields in the form on site A. Can I use wp_verify_nonce on site B to verify the nonce fields?
3
votes
0answers
261 views

WordPress REST API call generates nonce twice on every call

I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
3
votes
0answers
590 views

WordPress “Link has expired” error on updating posts

I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
3
votes
1answer
2k views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
2
votes
2answers
1k views

How to verify nonce from Bulk/Quick Edit in save_post?

I need to do something specific in my save_post callback for bulk and/or quick edits, so how do I check the nonce for that? I can only find _wpnonce in the edit.php html source, but can't find an ...
2
votes
1answer
728 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
2
votes
1answer
437 views

Should nonce be sanitized?

The general guideline is that we should sanitize all user input before using them. Now my questions is whether this applies to nonce or not. Which one is correct? wp_verify_nonce( ...
2
votes
1answer
4k views

How to stop _wpnonce and _wp_http_referer from appearing in URL

I am trying to develop a plug-in that has a search field and uses WP_List_Table. The plug-in is strictly for the backend and searches the users in the database and returns them along with some other ...
2
votes
1answer
667 views

Verify nonce in REST API?

I would like to understand the best practices regarding nonce validation in REST APIs. I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
2
votes
1answer
337 views

How to add Wordpress nonces to ajax request

I have a plugin, a cron job runs refresh_my_plugin() daily. I need a button on my plugins Settings/option page, allowing a user to manually run said function, and I want it inline, with ajax. I've ...
2
votes
1answer
468 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
2
votes
1answer
269 views

How to save multiple metaboxes?

I read a tutorial about metaboxes, most of things are clear but I have a question about multiple metaboxes. My question is about saving, in the tutorial: <?php add_action( 'save_post', '...
2
votes
1answer
647 views

Using nonce in menu item

I have a log out link in the main header menu, when you click on the link to log out, you are redirected to the page asking if you really want to log out. I know it's doing this because there is no ...
2
votes
1answer
930 views

wp_verify_nonce() via REST always returns false

I'm trying to create and verify nonce, and I did it almost the same way as described in wp_create_nonce. I believe it's related to REST api, but not sure where to investigate? How I create nonce: (...
2
votes
1answer
75 views

Nonce failing in IE

I have a strange issue that seems to affect IE but not Chrome (I haven't tried any other browsers) I'm generating a form with a nonce using the following code - <?php wp_nonce_field('solution-reg'...
2
votes
1answer
26 views

Nonce actions and names available via open source

I am using a plugin which makes its code publicly available. Therefore, anyone can see the $action and $name parameters used to generate the nonces. Does this make my site more vulnerable since ...
2
votes
2answers
2k views

AJAX requests broken due to HTTPS for wp-admin

I have my wp-admin section forced to HTTPS via a plugin. I also have specific pages that are using https on the frontend (login, billing, etc.) I seem to be having an issue with HTTP pages using AJAX ...
2
votes
1answer
93 views

Using Nonces for AJAX that only retrieves data

Does it make sense to use a nonce on an AJAX action that only returns data and doesn't alter data on the server side? I understand they are important if you are saving data or changing something on ...
2
votes
1answer
663 views

Why does Wordpress Heartbeat login not refresh the nonces?

Here's an interesting experiment: Go to wordpress plugins listing page, notice the activate, deactivate links all have a nonce part in the request. In a second tab, log out of the site, and go back ...
2
votes
1answer
4k views

How to get the wpnonce value?

On using inspect element to check the 'href' attribute of 'Deactivate' links for the plugins listed on plugins.php page, I found that the url contains a wpnonce field with a certain value. I need to ...
2
votes
0answers
2k views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
1
vote
2answers
3k views

wp_verify_nonce always returns false when logged in as admin

I've implemented some AJAX functionality for my plugin and it works fine as long as I'm not logged in as admin - then wp_verify_nonce fails. It works for unauthorized users and authorized regular ...
1
vote
1answer
705 views

Verify Nonce returns false - Request Nonce returns correct value

I'm trying to verify that the nonce I created exists but for some reason it keeps returning false, why is this happening? Creating my nonce: <?php wp_nonce_field('test_slider_action','...
1
vote
2answers
5k views

Undefined index: at_nonce in custom post metabox

I'm getting this error with my custom post metabox. The custom post and metabox works fine, but if i have debug on and when i try to save any other page or post, i will get an error: Notice: ...
1
vote
1answer
345 views

What SQL / WordPress queries would need a nonce?

I'm a PHP / JavaScript developer and I'm new to WordPress. Our company's website is build upon WordPress. However I created many custom PHP pages without minding the WordPress framework much. When ...