Here’s an interesting experiment: Go to wordpress plugins listing page, notice the activate, deactivate links all have a nonce part in the request.
In a second tab, log out of the site, and go back to plugin listing page.
After awhile, the page realizes it’s not logged in, and pops up a log in screen. Log in, and click an “activate” or “deactivate” button.
Notice it gives the nonce-failure message, “are you sure you want to do this”? Because the previous session’s nonces don’t work. Why does WordPress not know to refresh these nonces? I thought new nonces would be sent back as a heartbeat-ajax, but it looks like there isn’t an ajax request with the login screen.
Update: It seems this is called when the user logs in, but I guess not too many scripts are smart about acting on this trigger?
$( document ).on( 'heartbeat-tick.wp-auth-check', function( e, data ) {
if ( 'wp-auth-check' in data ) {
schedule();
if ( ! data['wp-auth-check'] && wrap.hasClass('hidden') ) {
show();
} else if ( data['wp-auth-check'] && ! wrap.hasClass('hidden') ) {
hide();
}
}
}).