Does it make sense to check a nonce on user log in?
Does it make sense to check a nonce on user log in?
nonce
Unable to update plugins or log out
Unable to update plugins or log out
whether a nonce is required for get type and get_query_var?
whether a nonce is required for get type and get_query_var?
Why are nonces working in Firefox but not in Chrome?
Turning off a cache plugin, Fast Cache in this case, and adding ‘define(‘WP_CACHE’, false);’ to the wp-config.php file seems to have resolved this issue.
How do I mitigate replay attacks when talking about actions that shouldn’t happen twice?
How do I mitigate replay attacks when talking about actions that shouldn’t happen twice?
How to not cache nonces with WP Rocket?
Find the specific AJAX call URL and prevent that being cached with the WP-Rocket advanced rules settings. https://docs.wp-rocket.me/article/54-exclude-pages-from-the-cache. As per your comment, you need a strategy for not having the nonce in a file that can be cached such as javascript files, so as you said, use PHP to generate the nonce and pass it … Read more
wp_verify_nonce not working on the mobile device
wp_verify_nonce not working on the mobile device
Change button link to add nonce
Use wp_logout_url() https://developer.wordpress.org/reference/functions/wp_logout_url/ <a href=”<?php echo wp_logout_url(); ?>”>Logout</a>
Using a nonce Content Security Policy header for style-src for inline style elements returns errors
It seems like you added the nonce to the script-src directive but not to the style-src directive. This might be the reason that why scripts are working but styles are not. Possible solution: “style-src ‘self’ https://fonts.googleapis.com ‘nonce-“.tu_custom_nonce_value () .”‘;”. “script-src ‘self’ https://maps.googleapis.com https://www.googletagmanager.com https://ajax.googleapis.com https://ajax.cloudflare.com https://static.cloudflareinsights.com https://cdnjs.cloudflare.com ‘nonce-“.tu_custom_nonce_value () .”‘;”;
CSP nonces with Cloudflare Workers
Thank you for your answer, you are absolutely right. I also corrected my mistake. I’ll post the code if it helps. Code for Cloudflare Workers: https://gist.github.com/richie5um/b2999177b27095af13ec619e44742116 Code for WordPress : add_filter( ‘script_loader_tag’, ‘add_nonce_to_script’, 10, 3 ); function add_nonce_to_script( $tag, $handle, $source ) { $search = “type=”text/javascript””; $replace = “type=”text/javascript” nonce=”””; $subject = $tag; $output = … Read more