WordPress & _nonce

Hello,

I have a problem with the nonce issue. For me, the nonce value always stays the same. This also does not change across browsers or when I activate the Inkoknito mode. Is this a normal behavior?

I only noticed this because when logged in, the form nonce is not the same as the validation nonce. The validation failed. However, only when I am logged in. Otherwise the form and the send works. Only the nonce does not change. I find this currently very strange I would appreciate any help, explanations or experiences.

Here is some background information:

• no active caching active, neither by serverconfig nor by plugin.
• Theme from https://underscores.me/
• Plugins ACF, Polylang, WP Mail SMTP, Yoast active.

I have a home page, on it there is a popup which is activated via JS and the HTML block is changed to display:block;.

In this process the nonce is created in the form. I have tested two variants:

<?php #wp_nonce_field( 'popup_form_nonce', '_wpnonce' ); ?> and 
<input type="hidden" name="_wpnonce" id="popup_form_nonce" value="<?php #echo wp_create_nonce('popup_form_nonce'); ?>" />

Interestingly, the nonce value was the same for both.

When the form is submitted, it runs in a JS check and then it is forwarded with “fetch(‘/wp-json/popupmailer/v1/mail” and processed server-side.

let object = {};
  formData.forEach(function(value, key){
    object[key] = value;
  });
  
  // send data
  fetch('/wp-json/popupmailer/v1/mail', {
    method: 'POST',
    headers: {
      'content-type': 'application/json'
    },
    body: JSON.stringify(object)
  })
  // .then(response => response.json())
  .then(response => response.text())
  .then(data => {
    console.log('response text:', data);
    const jsonData = JSON.parse(data);

Server-side processing

	$nonce = $request->get_param('_wpnonce');
	$server_nonce = wp_create_nonce('popup_form_nonce');
	
	error_log(print_r($request->get_params(), true));
	error_log('Nonce: ' . $nonce);
	error_log('Name: ' . $request->get_param('name'));
	error_log('Tel: ' . $request->get_param('tel'));
	error_log('Time: ' . $request->get_param('time'));

	if (!wp_verify_nonce($nonce, 'popup_form_nonce')) {
		return new WP_REST_Response(array('status' => 'error', 'message' => 'Invalid nonce', 'nonce_received' => $nonce, 'server_nonce' => $server_nonce, 'request_parameters' => $request->get_params()), 403);
	}