nonce

Are Nonces Useless?

by

This is probably a noob question BUT hear me out – isn’t the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document like so: /* <![CDATA[ */ var nc_ajax_getpost = { …stuff… getpostNonce: “8a3318a44c” }; /* ]]> */ So if … Read more

Nonce retrieved from the REST API is invalid and different from nonce generated in wp_localize_script

by

For those that arrive from Google: You probably shouldn’t get the nonces from the REST API, unless you really know what you’re doing. Cookie-based authentication with the REST API is only meant for plugins and themes. For a single page application, you should probably use OAuth. This question exists because the documentation isn’t/wasn’t clear on … Read more

Can I use the same nonce for multiple requests on the same page?

by

Or does this break the purpose of the nonce, which I admint I don’t quite understand it? 🙂 For example on two ajax requests that run on page load, or when something is clicked: $.ajax({ type: ‘post’, url: ‘admin-ajax.php’, data: { action: ‘foo’, _ajax_nonce: ‘<?php echo $nonce; ?>’ } }); $.ajax({ type: ‘post’, url: ‘admin-ajax.php’, … Read more

How does nonce verification work?

by

I can see that wp_nonce_field generates a value in the hidden field. <input type=”hidden” id=”message-send” name=”message-send” value=”cabfd9e42d” /> But wp_verify_nonce isn’t using that value as far as I can tell, but I may be wrong. It looks like it’s using a session token for verification. $expected = substr( wp_hash( $i . ‘|’ . $action . … Read more

Do I need a nonce field for every meta box I add to my custom post type admin?

by

I’m currently working on the admin page of my custom post type, and I got stuck on deciding whether to add a nonce field again for the second metabox or not. I’m very new to custom post types, and searching online about this doesn’t really yield that many results. Any thoughts? Thanks. 4 I would … Read more