Nonce check causing issues when creating new post

I know that this is not the only tutorial that has code that check nonce for meta boxes but this is truly idiotic. Nonce should be checked per the whole action not per parts of it and if your save_post hook was called it means that the save nonce was already checked and found valid, so There is no need for more security checks.

My advice is to simply remove anything related to nonce from your metabox code, but if you will feel better having it around just change the code to 

   // verify nonce
    if ( !isset($_POST[ 'my_meta_box_nonce' ]) || !wp_verify_nonce( $_POST[ 'my_meta_box_nonce' ], basename( __FILE__ ) ) ) 
       return $post_id;

which will bail out when no nonce was supplied or the nonce failed validation

Related Posts:

  1. How does nonce verification work?
  2. How to expire a nonce?
  3. Fatal error: Call to undefined function wp_create_nonce()
  4. How to add/retrieve the post trash link?
  5. Using nonce external of WP Admin
  6. Nonce best practices: hidden input vs. wp_localize_script?
  7. “The link you followed has expired” when previewing a post
  8. wp_verify_nonce keeps failing
  9. Handling nonce generation in AJAX registration process
  10. increase nonce lifespan
  11. wp_verify_nonce() via REST always returns false
  12. Nonce failing in IE
  13. my theme breaks WP export
  14. Why am I getting a 403 from check_admin_referer()?
  15. x-wp-nonce across domains
  16. wp_create_nonce doesn’t verify when using WP_List_Table
  17. Handling expired nonces
  18. What is really “wp_nonce_field” and how does it work? [duplicate]
  19. Cannot verify nonce
  20. wp_verify_nonce return false despite correct parameter passed
  21. WordPress JSON API nonces and Vue development server
  22. Verify a nonce in Form submission
  23. phpcs error in WordPress
  24. Stop WordPress nonces expiring
  25. Several nonces?
  26. Nonce for Trashing Item
  27. Nonce keeps failing
  28. Public posts – preventing duplicate form submissions
  29. How to obtain “wp_rest” nonce for WP Statistics plugin manually?
  30. WordPress “nonce” message
  31. CSP nonces with Cloudflare Workers
  32. Why are nonces working in Firefox but not in Chrome?
  33. wp_verfy_nonce keeps giving false
  34. Nonce – reissue with ajax poll
  35. wp_nonce_url generating invalid links
  36. How to insert wp_nonce field within echoed string
  37. Weird nonce validation problem
  38. Logout button in menu without “wp” in links
  39. Check nonce in the new bulk_edit_posts action
  40. wp_verify_nonce vs check_admin_referer
  41. Do I need a nonce field for every meta box I add to my custom post type admin?
  42. Can I use the same nonce for multiple requests on the same page?
  43. Nonces and Cache
  44. Multiple ajax nonce requests
  45. What is nonce and how to use it with Ajax in WordPress? [duplicate]
  46. Nonce in settings API with tabbed navigation
  47. WordPress “Link has expired” error on updating posts
  48. Headless WordPress: How to authenticate front end requests?
  49. Nonces and Ajax request to REST API and verification
  50. How to stop _wpnonce and _wp_http_referer from appearing in URL
  51. Serving nonces through AJAX is not refreshing nonce, returning 403 error
  52. Security around save_post hook
  53. ajax and nonce when JavaScript is in a seperate file
  54. wp_verify_nonce doesn’t return true on server when it matches the nonce
  55. Full page NGINX (or Cloudflare) caching and WordPress nonces
  56. Verify Nonce returns false – Request Nonce returns correct value
  57. Why save_post_$(custom_post_type) is fired even if I am not already saving a post?
  58. wp-admin AJAX with Fetch API is done without user
  59. How can I create a plugin installation link?
  60. Can a wp_nonce created from domain 1 to be verified on domain 2?
  61. Help with forms and nonces
  62. permission_callback has no effect
  63. Confusion regarding Nonce & using it in Custom Columns for Saving Checkbox Value to Post Meta
  64. WP REST API – Nonce passes wp_verify_nonce even after logout
  65. Custom post type: check permissions and validate nonce
  66. “The link you followed has expired” & “Error while saving” messages when adding new post
  67. SSO autologin WordPress + Ajax
  68. Is nonce in PHP form and Ajax both necessary?
  69. Are nonces in WP REST API optional by default?
  70. Nonce fails on ajax save
  71. Can you have more than one nonce on a page?
  72. Form Security: nonce vs. jQuery
  73. wp_nonce_field is breaking form for reasons unknown
  74. Cache plugins and ajax nonce verification
  75. Nonce doesn’t validate in nopriv call
  76. Should I use wp_nonce_field on my contact form?
  77. Why does check_ajax_referer give a 403 error on https websites?
  78. WordPress is creating nonce as a logged in user but verifying it incorrectly
  79. How to use nonce
  80. Where to use nonce
  81. Re-use Nonce in Repeating Event Signup Buttons
  82. How to add a WordPress Nonce for this form to avoid CSRF
  83. How to verify which WordPress user requested the API in ASP .NET Core?
  84. Reliable way to add nonce to HTTP Header in WordPress?
  85. Log out without confirmation request (nonce)
  86. wp_nonce vs jwt
  87. Using a nonce Content Security Policy header for style-src for inline style elements returns errors
  88. wp_verify_nonce not working on the mobile device
  89. How to not cache nonces with WP Rocket?
  90. whether a nonce is required for get type and get_query_var?
  91. Unable to update plugins or log out
  92. Does it make sense to check a nonce on user log in?
  93. Override plugin function to show invoices even if not logged in
  94. CSRF attack to create USER
  95. 403 Forbidden on site logo image upload
  96. Nonce and widget
  97. Is it necessary to use a WordPress nonce when allowing users to download public data?
  98. Wp doesn’t save meta box data
  99. Is there a solution to expired nonces in forms when using full page caching that doesn’t involve configuring the cache?
  100. Nonce code vulnerability