basically you should not use nonce for non logged in users, and if you have to, then have page can not be cached otherwise users will think there is something wrong with the site. A middle ground is to have short time caching for like 1 minute but good luck with explaining that to most … Read more
wp_nonce_field() will echo its output by default, so set the $echo parameter to false: add_shortcode(‘signup_form’, ‘get_signup_form’); function get_signup_form() { $wp_nonce_code = wp_nonce_field( -1, ‘_wpnonce’, true, false ); $signup_form_code = <<<EOT <form method=”post” class=”popup-register” action=”/my-account/”> <p style=”text-align:center;”> <input type=”email” class=”popup-input” style=”width: 65%;” name=”email” id=”reg_email” placeholder=”Enter your email address”> <input type=”submit” class=”popup-input-submit button” style=”margin: 0; border: 1px … Read more
What you are doing wrong is using nonce in a context it was not intended to be used in. nonces should be used on web pages for logged in users, not just a random “it has something to do with security so it has to be right” kind of measure ;). If you need to … Read more
You don’t need a nonce for every field, a single nonce should suffice This is because a nonce isn’t tied to a field, it’s tied to a request, and verifies that you did indeed intend to press update, or click a link, submit a form, etc As an example, back in the days of MySpace, … Read more
First, nonce for an action is the same when the user is not authenticated/logged-in. (because the user ID is always 0) Secondly, you’re getting false because you didn’t specify the nonce action which is wp_rest in your case: // Correct usage – a valid action name is set (wp_rest). wp_verify_nonce( $clientNonce, ‘wp_rest’ ); // Incorrect … Read more
With the user-name-based nonces, i think you are trying to protect yourself from CSRF attacks, this should work to some extent (hard to tell without the full source code), that being said the nonces should be assigned to a specific action (not only an action), so, for example, you do not assign it to a … Read more
Looking at the documentation, the 2nd argument of check_ajax_referer() is: (false|string) (Optional) Key to check for the nonce in $_REQUEST (since 2.5). If false, $_REQUEST values will be evaluated for ‘_ajax_nonce’, and ‘_wpnonce’ (in that order). Not the value itself. So the correct usage would be: check_ajax_referer(‘fmsapi_refresh_nonce’, ‘security’ );
If you’re going to add the nonce field to an HTML string, you have to specify that you don’t want it echoed. That’s the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952 $formDisplay .= wp_nonce_field( ‘contact-form’, ‘_wpnonce’, true, false );
jQuery is a js library not a transport protocol, your data is sent via GET or POST, wether you use jquery or not. Think of it like this, sometimes it’s the user in the first frame, sometimes it’s javascript: Firstly nonces are not the same as sanitisation, they have different purposes Sanitisation is about verifying … Read more
wp_nonce_field() means the nonce field is used to validate that the contents of the form came from the location on the current site and not somewhere else.