The CSP-ANTS&ST plugin seems to work very well, and it is very simple. Why can’t WP do something even better to help with this very basic security need?

WordPress really ought to set up nonces (or hashes) for all their inline scripts, and a system to use them. Do you know if that is in the works? Or if there is a plugin that will do this, if yours doesn’t?

If your plugin does help set up hashes or nonces to authorize inline scripts, please point me to instructions for getting this going.

Thanks!

If anyone comes here looking for a fix, I have submitted a PR that resolves the issue.

I was using Disk: Enhanced as the method for the page caching, and after around 24 hours I was getting nonce invalid issues. I cleared the cache and it returned to normal.

I’m assuming there might have been an issue where the cached page had expired nonces.

To help at this not happening I’ve placed this code inside a custom plugin of mine:

// Schedule the cache purge to run every 10 hours
add_action( 'wp', function() {
    if ( ! wp_next_scheduled( 'my_purge_w3tc_cache' ) ) {
        wp_schedule_event( time(), 'every_10_hours', 'my_purge_w3tc_cache' );
    }
} );

// Define the "every_10_hours" time interval
add_filter( 'cron_schedules', function( $schedules ) {
    $schedules['every_10_hours'] = array(
        'interval' => 36000, // 10 hours in seconds
        'display'  => __( 'Every 10 hours' ),
    );
    return $schedules;
} );

function my_purge_w3tc_cache() {
    if ( function_exists( 'w3tc_flush_all' ) ) {
        w3tc_flush_all();
    }
}

The code creates a cron job to purge the cache every 10 hours.

My question is, even using the regular cache lifespan built in the plugin, isn’t invalid nonces a matter of probability.

Lets say a nonce lasts 24 hours, with my 10 hour interval this scenario could occur:

Nonce |————————|————————|————————|
Purge |———-|———-|———-|———-|———-|———-|———-|

After the third purge, the cache will be left with the first generated nonce, but after less than 4 hours the nonce will no longer be valid and the cache will remain with the invalid nonce for another 6 hours or more.

What is the solution to this?

EDIT: Another option would be to purge the page and reload in case the user failed a nonce:

function wp_verify_nonce_failed_clean_cache($nonce, $action, $user, $token){

    global $post;
    $current_page_id = $post->ID;

	if($current_page_id && !$user->ID){
		w3tc_flush_post( $current_page_id );
		wp_redirect( get_permalink() );
		exit;
	}

}
add_action( 'wp_verify_nonce_failed', 'wp_verify_nonce_failed_clean_cache', 10, 4 );

Thank you.

One of the Automatticians at the VIP Developer Workshop told me that I should always (always) use a security nonce for ajax requests, even for not-logged-in users and requests that do not result in database or filesystem modification.

My theme uses an ajax modal login / registration form in the frontend, where a nonce verification is implemented for the registration process – but not for the login one. Does that really make sense?

Even wordpress does not use nonces for login / registration in wp-login.php. Woocommerce on the other hand does use nonces in the login / registration forms. This is really confusing – what is the best practice – the wordpress- or the woocommerce way? From a security point of view, does it make sense at all to use nonces for not-logged-in users in the login / registration process?

Three days ago I discovered that the ESI it’s not properly working, even I have untouched the ESI nonces added in the plugin 6 months ago.

ESI nonces:
load_more_posts private
load_more_clienti private

I have int he console the following error:
Uncaught ReferenceError: __litespeed_var_2__ is not defined
and also for above mentioned ESI nonces I have 403 errors for the admin ajax calls.

I did some Googleing and saw that it could be a nonce/caching issue. We’re using WPRocket on this site. But I’m unclear how to exclude the form/Optin Cat from nonces.

What steps do I need to take to fix this?

I have been using Helpful for 1 day now and received several useful feedback from my site’s visitor.

However, I also noticed that Helpful stops working after a few hours. After some digging, I found that Helpful needs new Nonces once the previous one is expired, I can be wrong about this.

According to this link, WordPress nonce is valid for 24 hours by default but unsure whether Helpful has set a different validity for the nonce.

Can you tell me what nonce validity Helpful follows so that I can change the TTL of Wp-Rocket and Cloudflare’s cache?