First, nonce for an action is the same when the user is not authenticated/logged-in. (because the user ID is always 0
)
Secondly, you’re getting false
because you didn’t specify the nonce action which is wp_rest
in your case:
// Correct usage - a valid action name is set (wp_rest).
wp_verify_nonce( $clientNonce, 'wp_rest' );
// Incorrect usage - empty action; always returns false.
wp_verify_nonce( $clientNonce );
And if you are actually trying to authenticate the request using the standard cookie authentication, then you should use the X-WP-Nonce
header to send the nonce and not the request body
/payload:
const fetchAllCoupons = async () => {
try {
const response = await fetch(`${apiBaseUrl}/pluginFolder/1.0/loadAll`, {
method: 'post',
headers: {
'Content-Type': 'application/json',
'X-WP-Nonce': clientNonce // <- here, send the nonce via the header
},
body: JSON.stringify({
// WordPress will not use this when verifying the associated user in the request.
clientNonce,
// but WordPress will not use this, either. Because we're sending a JSON payload.
_wpnonce: clientNonce
})
});
...
} catch (e) {
...
}
};
Or you can also send the nonce as a query string (in the URL) like so:
`${apiBaseUrl}/pluginFolder/1.0/loadAll?_wpnonce=` + clientNonce