Questions tagged [nonce]
The nonce tag has no usage guidance.
69
questions with no upvoted or accepted answers
6
votes
0
answers
1k
views
WordPress REST API call generates nonce twice on every call
I'm trying to login a user via the REST API, and then retrieve the current user on subsequent requests. As per the documentation, in my plugin, I am creating and retrieving a nonce after a successful ...
- 111
4
votes
1
answer
2k
views
WordPress “Link has expired” error on updating posts
I'm maintaining a WordPress site on GoDaddy for a client and they started to get the "this link has expired error" when they saved a post. It does not happen when I upload a file. However, I am ...
- 91
3
votes
0
answers
424
views
Wordpress password reset - why post rp_key?
I'm developing a plugin and after reading through wp-login.php, I can't seem to work out why some things are done the way they are.
Why does WordPress hide the reset password key from the URL?
After ...
- 88
3
votes
1
answer
1k
views
Why does Wordpress Heartbeat login not refresh the nonces?
Here's an interesting experiment: Go to wordpress plugins listing page, notice the activate, deactivate links all have a nonce part in the request.
In a second tab, log out of the site, and go back ...
- 452
2
votes
0
answers
578
views
Log in user using Wordpress REST API
I am having problems authenticating a user after logging in using a custom endpoint using the WordPress REST API.
I'm aware that this is not the perfect approach but I am just trying to make a few ...
- 163
2
votes
0
answers
650
views
Nonces, AJAX, script variables & security in WordPress
Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using:
wp_enqueue_script(
'script_handle',
PATH_TO_SCRIPT,
array(),
'1.0.0',
true
);
...
- 487
2
votes
0
answers
946
views
Full page NGINX (or Cloudflare) caching and WordPress nonces
Goal: I want to cache the full WordPress response via NGINX and exclusively use the REST API for the user specific parts.
Issue: I can't get an authenticated nonce to use against the API.
My plan ...
- 447
2
votes
1
answer
230
views
SSO autologin Wordpress + Ajax
That one keeps me awake at night.
The problem is that the user is properly logging in, but AFTER page refresh and should be immediately logged in without page reload. Need a fresh eyes to look at it.
...
- 25
1
vote
0
answers
11
views
nonce_user_logged_out to assign guests unique nonces breaks ajax calls
I've been researching implementing unique guest nonces via nonce_user_logged_out - for reference. So far I can generate nonces for the random UID I create:
add_filter( 'nonce_user_logged_out', '...
- 11
1
vote
0
answers
13
views
Nonce verification problem when logging in after a logout
I'm having a problem with nonce verification. The theme I'm using has an AJAX login form that has nonce as a hidden field. It normally goes to my account page after a logout, and I can re-login from ...
- 11
1
vote
0
answers
32
views
wp_localize_script being cached
I've faced a problem of nonce value is being cached.
I've embed the nonce in html by using wp_localize_script()
However, the cache plugin has cached this value. Which result in nonce invalid from time ...
- 11
1
vote
1
answer
41
views
How to use nonce
I am learning Plugin development. I have several MetaBox call back functions. In this regard where should I use wp_nonce_field() ?
- 203
1
vote
0
answers
381
views
"The link you followed has expired" & "Error while saving" messages when adding new post
I'm currently unable to publish new posts on my wordpress site. Whenever I try, I get a "The link you followed has expired" error after clicking the "publish" button. Also, as I'm ...
- 81
1
vote
1
answer
297
views
Nonce failing on form submission
I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1
answer
1k
views
Found 2 elements with non-unique id (#_ajax_nonce) and (#_wpnonce)
I am developing custom theme from scratch and creates a custom post type and getting this warning while editing custom post type. I also design custom Meta box with two input fields and using nonce in ...
- 11
1
vote
0
answers
553
views
Draft preview and customize permission problems on multisite main site
So I've been stuck on this problem for quite a while now and it feels like I've tried everything. I would love for some support here.
Setup
A WordPress multisite with Bedrock structure
PHP 7.3.17 (...
- 11
1
vote
0
answers
376
views
x-wp-nonce across domains
I've installed WPML with a multiple domain configuration (one domain per language).
The wrong thing is that, when editing for example a post while using a different domain from the main, it just ...
- 85
1
vote
0
answers
70
views
Is nonce in PHP form and Ajax both necessary?
I have a php form which is submitted through jQuery Ajax. Previously i had used nonce with Ajax and PHP form seperately.
Here i am using wp_nonce_field() in PHP form. Is it necessary to use ...
- 57
1
vote
0
answers
148
views
Why ajax doesn't work on certain wordpress hooks and reload the page instead?
I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
0
answers
55
views
Why ajax doesn't work on certain wordpress hooks?
I built an ajax function which works perfectly when i hook it to admin_head or admin_notices hooks but it doesn't work when i hook it to manage_posts_extra_tablenav hook, instead of doing the ajax ...
1
vote
1
answer
494
views
How to check nonce lifetime value of plugins?
Dear StackExchange users,
I currently use the premium version of WP Fastest Cache Premium. My website loads very fast, but I always get a 403 error for wp-admin/ajax.
I believe there is a plugin ...
- 53
1
vote
0
answers
1k
views
Are nonces in WP REST API optional by default?
I'm switching my code from using wp-ajax to the REST API and got puzzled regarding the nonces. First of all, I find it weird that you have to use wp_rest only, since API has many different methods and ...
- 483
1
vote
0
answers
558
views
Encountering "Wrong nonce. Action prohibitied." when trying to alter User Role and unable to Post via WP Admin
The plugin in question that I believe is displaying this message is the User Role Editor, although I do not believe it is causing the issue as users who should have permissions to make posts on the ...
- 11
1
vote
0
answers
73
views
Is there value in using a wp_nonce for POST requests?
All of the examples I see using wp_create_nonce are in the context of a GET request. You embed a nonce in URLs to ensure malicious links or scripts can't trick a user into, say, deleting a post.
...
- 111
1
vote
0
answers
48
views
Nonce fails on ajax save
I have made options page with 2 forms and two separate nonce fields, and other input fields that I save with AJAX.
The issue is that every time I save and call my function to save options via AJAX I ...
- 1,939
1
vote
0
answers
795
views
Bypass nonce value while trashing a post
I want to move a post in trash but the condition is that simultaneously I need to delete some more posts. Sample Code:
jQuery(function($) {
$('#delete-action a').unbind();
$('#delete-action a'...
- 291
1
vote
0
answers
105
views
My custom write panels won't save data. What am I missing?
So far I've been reading some tutorials about ways to create Custom Write Panels. It seems that none of them will really work without some bug. I'd like to discuss one of those tuts here: http://www....
- 308
0
votes
1
answer
28
views
Nonce validation in REST API
I am creating a headless Wordpress website. Wordpress backend (port 8888), VueJS frontend (port 8081). Data is loaded via REST API. This works fine.
Now I want to implement the preview-functionality. ...
- 111
0
votes
0
answers
17
views
How to stop a nonce from being cached in an inline script, or alternatives to regenerate it if expired?
I have an inline script that gets added into some WordPress pages which fires an AJAX request. We pass a nonce in that script, when using full page caching that nonce might have expired and therefore ...
- 195
0
votes
0
answers
32
views
Accessing an auth protected custom WP API enpoint from remote origin
I'm creating a Chrome browser extension that connects to a WordPress through its custom REST API endpoints. Retrieving data types that don't require an authorized user to be logged in works fine, as ...
0
votes
0
answers
161
views
How do i set up ajax nonce
Follow the doc, I tried to set up X-WP-NONCE before ajax sent data to custom route, but it show wpApiSettings.nonce not defined. If don't set beforeSend, on the back end still can pass the nonce ...
- 1
0
votes
0
answers
48
views
WooCommerce Order Sync via Custom REST API Endpoint Failing
I have a WooCommerce website with a specialized plugin that syncs orders to a delivery company. This plugin adds a button next to each order in the orders table, which, when clicked, triggers a sync. ...
- 1
0
votes
0
answers
31
views
1st dynamic table row content is not saved on initial update
This is what is used in my plugin. A meta field that allows the user in a page editor to add table rows and three columns. As many rows as needed. The issue I am facing is I add a row, then populate ...
0
votes
1
answer
227
views
Rest API nonce is being cached
I'm building a custom Rest Api endpoint. User can call this endpoint via ajax request in the frontend together with nonce value which was created by
wp_localize_script( 'some-js', 'wpApiSettings', [
...
- 11
0
votes
1
answer
111
views
Wp doesn't save meta box data
My WP doesn't save my meta box data. I see the metabox and the field, but the data doesn't saving. Somebody could help me? Thank you. This is the code:
// 1. Metabox létrehozása
function my_meta_box(){...
- 1
0
votes
0
answers
115
views
Weird nonce validation problem
I have a front-end form (ie, should work for non-logged-in users) with a nonce - "my-nonce-name". The problem is that it sometimes verifies upon submission and sometimes not, for - to me - ...
- 35
0
votes
1
answer
117
views
How to obtain "wp_rest" nonce for WP Statistics plugin manually?
During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed.
To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-...
- 101
0
votes
0
answers
72
views
How to verify which WordPress user requested the API in ASP .NET Core?
I have a use-case where I have a WordPress site and an ASP .NET Core as a Restful API backend. I use the WordPress site entire for Frontend, CMS, and User Authentication.
On certain pages of my ...
0
votes
0
answers
156
views
WP_List_Table Inside Metabox With Bulk Actions Not Working on Submit
I'm trying to display a WP_List_table inside a metabox. The metabox is for questions which are from assessment_question custom post type.The metabox is being displayed on an other custom post type '...
0
votes
1
answer
88
views
WordPress "nonce" message
Random question but I can't work it out or find a solution. I need to find a way to change the WordPress "nonce" message.
I'd like to replace to replace "nonce" with "error&...
- 103
0
votes
1
answer
2k
views
Reliable way to add nonce to HTTP Header in WordPress?
I am trying to implement CSP on my wordpress site.
Inspired by this question, https://stackoverflow.com/questions/50002041/adding-nonce-to-script-tag I tried to build a way to add nonces to my ...
- 266
0
votes
1
answer
603
views
wp_nonce vs jwt
I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend.
What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
user179669
0
votes
1
answer
459
views
CSP nonces with Cloudflare Workers
Like this blog, I use Cloudflare Workers to inject CSP (Content Security Policy) nonce in headers : https://scotthelme.co.uk/csp-nonces-the-easy-way-with-cloudflare-workers/
This is functional.
Next, ...
- 1
0
votes
1
answer
381
views
Change button link to add nonce
I am making a Logout button, but in order for it to work properly the link needs to have the correct nonce ("site.com/wp-login.php?action=logout&wp_nonce=X".
I have found in another ...
- 101
0
votes
0
answers
253
views
wp_verify_nonce not working on the mobile device
I am using a very simple form request to and verify it through the wp_verify_nonce() function. It is working perfectly on the desktop. But not working on mobile devices( iPhone, Andriod ). Could ...
- 267
0
votes
0
answers
46
views
How do I mitigate replay attacks when talking about actions that shouldn't happen twice?
A nonce is supposed to first help me against CSRF and help against replay attacks is just a bonus if I "personalize" the nonce to something like pay-user-{id}, but here's the problem - if my link ...
- 174
0
votes
1
answer
330
views
Why are nonces working in Firefox but not in Chrome?
I created the nonce when I localize a script file:
wp_localize_script('cad-search', 'cad_ajax',
array( 'ajaxurl' => admin_url( 'admin-ajax.php' ),
'nonce'=> wp_create_nonce('...
- 711
0
votes
0
answers
120
views
whether a nonce is required for get type and get_query_var?
I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not.
I use the get_query_var method to modify the main query. It uses a get method.
whether a nonce is ...
user145078
0
votes
0
answers
53
views
Unable to update plugins or log out
The server my site was hosted on recently went down and someone else was able to fix it for me. I am unclear on what exactly the issues with the server were, but since the site came back up, my cron ...
- 345
0
votes
0
answers
192
views
Does it make sense to check a nonce on user log in?
I read the following blog post about implementing custom user log in:
http://natko.com/wordpress-ajax-login-without-a-plugin-the-right-way/
In the post, the author walks through some PHP code for ...
- 131