In order to ‘Register User’ or ‘Retrieve Password’, the authentication for a user with ‘Administrator’ role is required. While this is a delibrately done for security reasons, such implementation makes it very hard for Front End applications to implement a simple ‘Register’ or ‘Sign Up’ function.
The simple solution is use this wp-rest-user plugin. This ...
I'm answering my own question based on my tests. I asked this because it's something that I could not find googling, so I wanted to post a solution here.
wp_localize_script('foo', 'fooData', [
Based on the authentication documentation here - a nonce key needs to be passed with each request.
So if the nonce key is being cached on the frontend beyond its lifespan, you will need to hook into the API request before the authentication step and replace the cached nonce key with a valid one.
WordPress provides a rest_send_nocache_headers filter for ...
First, nonce for an action is the same when the user is not authenticated/logged-in. (because the user ID is always 0)
Secondly, you're getting false because you didn't specify the nonce action which is wp_rest in your case:
// Correct usage - a valid action name is set (wp_rest).
wp_verify_nonce( $clientNonce, 'wp_rest' );
// Incorrect usage - empty ...
For remote apps (cURL, Postman, etc.), or when not using the browser, you should use an authentication plugin like Application Passwords instead of sending the cookies.
But if you'd rather send the cookies, then copy and send the WordPress logged-in cookie named wordpress_logged_in_<hash>. Example in cURL:
curl -H "X-WP-Nonce: <nonce>" -X POST ...
Yes, nonces should always be used when an authenticated user is triggering an action via a GET/POST request. One of the main purposes of the nonce is it ensure that the current user actually intended to trigger this request. It prevents the security vulnerability known as Cross-Site Request Forgery (CSRF), where an attacker can trick an authenticated user ...
The nonce authentication method is only for requests made from within WordPress, as described in your own link (emphasis mine):
It is important to keep in mind that this authentication method relies
on WordPress cookies. As a result this method is only applicable
when the REST API is used inside of WordPress and the current user is
logged in. In ...
Found out what the problem was. Polylang plugin verifies the nonces, so you need to pass it the 'new-post-translation' arg.
The solution is:
wp_nonce_url( $link, 'new-post-translation' );
it might help someone, but maybe no ;)
The API handles the nonce for the form part because you're using the settings_fields call, which outputs the *-options nonce, and you're passing the data to the options.php file for saving, which checks that nonce for you before saving the settings. This part the Settings API does indeed do for you.
However, your tab code is not in that form. It's just ...
This is proper warning. No API takes care about nonce.
You have to use verify_nonce() or check_admin_referer() before reading from $_GET or $_POST.
And it is better to use the full set of coding standards, named simply WordPress, which includes Core, Docs, and Extra.
I went for the solution as suggested by @Rup in the comments. Replacing the two nonce functions, wp_create_nonce() and wp_verify_nonce() to prefix a nonce with a 1 or a 0 for logged-in and logged-out users respectively.
The logged out nonces work by IP rather than User ID and session Token. Thus, allowing for nonces to carry over after a login. As far as I ...
Nonces are not the way to solve your problem. You're using it correctly. I would look at the $wpdb->insert array you're probably using, and implement a check for data to exist that matches the proposed "new" entry.
I actually set up a Twilio SMS to fire off when weird validation errors are encountered. I have it text me a message and the database row id. ...
If you use nonces properly, it won't be possible to make the site to process fake request... So this part should be secure, but... There is still one security flaw in your approach...
What if I can make you to run my JS script in your browser, while you're logged in as admin? It is possible.
This way nonce won't cause validation error and your code will ...