admin-ajax.php shows 403 popup after 24h

  • Resolved luc3283

    (@john5171)


    5 years, 7 months ago

    This issue has already been documented and partially solved here.

    It happens because Litespeed is caching the nonce (security token) value, therefore once it expires, the 403 error occurs. The lifespan of a nonce is 12 hours by default and after around 24 hours of clearing the cache, I start getting the error.

    Can you please tell me a solution?

    The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)

  • Hi @john5171, can you try to update Setting > Default Public Cache TTL to 43100 temporarily to see is it back to normal? Also, may I know which plugin is using the nonce for verifying?

    Plugin Support Hai Zheng?

    (@hailite)

    Can you tell which plugin used that nonce? The default one is already automatically converted to ESI by LSCWP. If it is an special action nonce, need to find it and add it to ESI.

    Thread Starter luc3283

    (@john5171)

    I actually just fixed this issue.

    The plugin was Captcha by SimplyWordpress and the problem started after I selected the option “Show CAPTCHA after the end of the page loading”.

    I simply disabled that option, and admin-ajax is no longer loading.

    Plugin Support Hai Zheng?

    (@hailite)

    I am not sure when that Captcha will show. But in source code you can see there is still a nonce value cached, which could cause captcha invalid when it is to be used. ESI will be a perfect way to permanently improve the compatibility.

    If you could do a whole folder search for wp_create_nonce in your plugin, could easily figure out which nonce action it is using. If it is a open source plugin, please give the download path, we can do a search too.

    Thread Starter luc3283

    (@john5171)

    Well the nonce you found in the source are not from the Captcha plugin. The problem was specific for pages that used that Captcha plugin. And as of now, the plugin no longer uses AJAX.

    I will wait and see if the problem is fixed after 24 hours. It should be fine.

    Are all nonce entries problematic? I don’t think they are…

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘admin-ajax.php shows 403 popup after 24h’ is closed to new replies.