With the user-name-based nonces, i think you are trying to protect yourself from CSRF attacks, this should work to some extent (hard to tell without the full source code), that being said the nonces should be assigned to a specific action (not only an action), so, for example, you do not assign it to a "delete item" action but rather to "delete item with ID=...
Yes, nonces should always be used when an authenticated user is triggering an action via a GET/POST request. One of the main purposes of the nonce is it ensure that the current user actually intended to trigger this request. It prevents the security vulnerability known as Cross-Site Request Forgery (CSRF), where an attacker can trick an authenticated user ...
Building on what @lucas-bustamante wrote (which helped me a ton!), once you have the X-WP-Nonce header setup in your custom routes you can do the following:
register_rest_route('v1', '/my_post', [
'methods' => WP_REST_Server::CREATABLE,
'callback' => [$this, 'create_post'],
'args' => [
'post_title' => [
For making authenticated API requests from a third party app, you'll need to install a plugin to give you different methods of authentication.
The most convenient but less secure is Basic Authentication: https://github.com/WP-API/Basic-Auth, it's appropriate for a local development environment.
This allows you to make authenticated requests by passing ...
This is happening because a separate nonce with the action wp_rest is not being sent by the server to the client and received back from the client in an HTTP request header called X-WP-Nonce with every REST request.
To get this working, you will have to generate a nonce like this:
...and provide it to the client making the rest ...
Problem is, you are submitting data as POST data, but verifying nonce from GET data.
Here is how you can create a nonce field in a form easily:
wp_nonce_field( 'add_new_addres' );
Actually, I personally don't use more than 1 parameter when calling the wp_nonce_field function.
Then when verify use the following code:
if ( ! wp_verify_nonce( $_POST['_wpnonce']...
Ok, so technically I didn't solve the issue that prevented me from accessing posts in draft status from an external domain where the frontend is hosted using only nonce values. My guess is that the logged_in cookie was not set/could not be read on the frontend side to verify the nonce value during an external AJAX request.
That being said, I installed the ...
You just need to send the nonce along with your AJAX data:
url : profile_edit.ajaxurl,
data: $('#profile_update').serialize() +
'&my_nonce=' + profile_edit.nonce +
'&action=update_profile_post', // don't forget the action name!
Alternatively, since you're using jQuery's serialize() function, ...
From the documentation:
Backbone.sync is the function that Backbone calls every time it attempts to read or save a model to the server. By default, it uses jQuery.ajax to make a RESTful JSON request and returns a jqXHR.
The sync function may be overridden globally as Backbone.sync, or at a finer-grained level, by adding a sync function to a Backbone ...