Nonce best practices: hidden input vs. wp_localize_script?

Depends, will the form work with AJAX turned off?

If so use an input and degrade gracefully.

Otherwise, define nonces used by JS using JS for consistency, and to prevent grabbing stuff from the DOM

Related Posts:

  1. How does nonce verification work?
  2. How to expire a nonce?
  3. Fatal error: Call to undefined function wp_create_nonce()
  4. How to add/retrieve the post trash link?
  5. Using nonce external of WP Admin
  6. “The link you followed has expired” when previewing a post
  7. wp_verify_nonce keeps failing
  8. Handling nonce generation in AJAX registration process
  9. increase nonce lifespan
  10. wp_verify_nonce() via REST always returns false
  11. Nonce failing in IE
  12. Nonces, AJAX, script variables & security in WordPress
  13. my theme breaks WP export
  14. Why am I getting a 403 from check_admin_referer()?
  15. how to send Ajax request in wordpress backend
  16. x-wp-nonce across domains
  17. wp_create_nonce doesn’t verify when using WP_List_Table
  18. Handling expired nonces
  19. What is really “wp_nonce_field” and how does it work? [duplicate]
  20. Cannot verify nonce
  21. wp_verify_nonce return false despite correct parameter passed
  22. WordPress JSON API nonces and Vue development server
  23. Verify a nonce in Form submission
  24. phpcs error in WordPress
  25. Stop WordPress nonces expiring
  26. Several nonces?
  27. Nonce for Trashing Item
  28. Nonce keeps failing
  29. Public posts – preventing duplicate form submissions
  30. How to obtain “wp_rest” nonce for WP Statistics plugin manually?
  31. WordPress “nonce” message
  32. CSP nonces with Cloudflare Workers
  33. Why are nonces working in Firefox but not in Chrome?
  34. wp_verfy_nonce keeps giving false
  35. Nonce – reissue with ajax poll
  36. wp_nonce_url generating invalid links
  37. How to insert wp_nonce field within echoed string
  38. Nonce check causing issues when creating new post
  39. WordPress wp_localize_script nonce and ajax URL
  40. Weird nonce validation problem
  41. Logout button in menu without “wp” in links
  42. Check nonce in the new bulk_edit_posts action
  43. wp_verify_nonce vs check_admin_referer
  44. Do I need a nonce field for every meta box I add to my custom post type admin?
  45. Can I use the same nonce for multiple requests on the same page?
  46. Multiple ajax nonce requests
  47. Nonce in settings API with tabbed navigation
  48. WordPress “Link has expired” error on updating posts
  49. Can I verify nonce which was generated on a different WP site?
  50. Headless WordPress: How to authenticate front end requests?
  51. Nonces and Ajax request to REST API and verification
  52. How to stop _wpnonce and _wp_http_referer from appearing in URL
  53. Can’t seem to get wp_localize_script to work
  54. WP_LOCALIZE_SCRIPT doesn’t work
  55. wp_verify_nonce doesn’t return true on server when it matches the nonce
  56. Verify Nonce returns false – Request Nonce returns correct value
  57. wp-admin AJAX with Fetch API is done without user
  58. Using wp_localize_script to store the template url into a variable to use in JS
  59. How to Globally Use wp_localize_script() Ajax URL
  60. Get Current User info using wp_localize_script, in functions.php
  61. permission_callback has no effect
  62. Populate a Map at The Same Time as showing Posts via AJAX
  63. wp_localize_script not working on ajax response
  64. WP REST API – Nonce passes wp_verify_nonce even after logout
  65. Use of check_admin_referer with theme options and options.php
  66. Find out if enqueued script uses wp_localize_script?
  67. “The link you followed has expired” & “Error while saving” messages when adding new post
  68. SSO autologin WordPress + Ajax
  69. How to pass conditional array to wp_localize_script
  70. Is nonce in PHP form and Ajax both necessary?
  71. Integrating PHP into Javascript to display map markers with Google API – problem with wp_localize
  72. How to call wp_localize_script() after the script?
  73. How to enqueue the script without hardcoded in the theme files?
  74. How to register javascript variables in wp_localize_script?
  75. Nonce fails on ajax save
  76. Add action hook into wp_localize_script
  77. how to localized scripts of new page requested by ajax?
  78. Is it safe to use a global wp nonce per user instead of a nonce per action?
  79. Backbone with custom rest endpoints
  80. Using nonce when loading posts with AJAX
  81. wp_localize_script not passing the data
  82. Using template tags in external JS file
  83. Saving custom data via ajax with nonces
  84. Getting jQuery AJAX to work in WordPress (getting -1)
  85. Log in user using WordPress REST API
  86. WP_List_Table Inside Metabox With Bulk Actions Not Working on Submit
  87. How do I mitigate replay attacks when talking about actions that shouldn’t happen twice?
  88. localize_script or rest api
  89. Issue with wp_localize_script
  90. Translate string with wp_localize_script()
  91. How can I verify WordPress nonce from the following code?
  92. bundled jquery in theme js not working with wp_localize_script
  93. AJAX form not working, still reloads on submit
  94. wp localize script makes variable global, how to solve that?
  95. Multiple shortcodes only use attributes from one of the shortcodes on custom plugin
  96. Pass list of categories to JS
  97. Create nonce in frontend page to edit profile
  98. when saveing $meta_box i get Undefined index error
  99. Is Nonce Verification (CSRF) required for WordPress Custom Bulk User Actions?
  100. Nonce validation in REST API

Leave a Comment