nonce

Getting “The link you followed has expired” when adding custom post [closed]

The “The link you followed has expired” message is in the function wp_nonce_ays on line 2607 of wp-includes/functions.php. Apparently, the message was changed from “Are you sure you want to do this?” in 4.9.5. The wp_nonce_ays function is called by check_admin_referer if the nonce check fails. This is the only place in the WordPress code … Read more

Do I require the use of nonce?

I think required would mean that “it doesn’t work without it”. It will work, but the question is of security and best practices. Even if it doesn’t seem necessary, it’s better to play in the safe side and do it always. You have to enqueue your JavaScript like bellow, passing PHP values (like the admin … Read more

Multiple ajax nonce requests

That is basically the way WordPress does it and pretty much the only way to do it, simply have your receiving PHP function create a new nonce add send it back with your response, then just update the value on your JS before the next round.

Is it safe to assume that a nonce may be validated more than once?

1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function. To be more accurate, the lifetime is controlled by filter apply_filters( ‘nonce_life’, DAY_IN_SECONDS ); 2, if the lifetime value makes you doubt if it is “an implementation side-effect”, you may want to add_filter(‘nonce_life’,create_function(‘$v’, ‘return 60*5;’)); to shorten the … Read more

Using nonce in menu item

Just add a filter: function change_menu($items){ foreach($items as $item){ if( $item->title == “Log Out”){ $item->url = $item->url . “&_wpnonce=” . wp_create_nonce( ‘log-out’ ); } } return $items; } add_filter(‘wp_nav_menu_objects’, ‘change_menu’);

Verify nonce in REST API?

You should pass the special wp_rest nonce as part of the request. Without it, the global $current_user object will not be available in your REST class. You can pass this from several ways, from $_GET to $_POST to headers. The action nonce is optional. If you add it, you can’t use the REST endpoint from … Read more

AJAX nonce with check_ajax_referer()

Difficult to say for sure where the mistake is as you have not mentioned about your add_action(‘wp_ajax_my_function’,’whatever_callback’);which I think you missed out on that. But your question is missing info in this respect. This is how I would get on about this: In your functions.php file or similar: add_action(wp_ajax_handle_login, ‘handle_login_ajax’); add_action(wp_ajax_nopriv_handle_login, ‘handle_login_ajax’); Make sure your … Read more

+ More