wp_verify_nonce and cloudflare incompatibility

  • Resolved linusgr

    (@linusgr)


    8 years, 5 months ago

    Hi,

    Currently i am using cloudflare page rules in order to cache also HTML pages.
    I am posting here because it is WordPress specific the issue i am experiencing
    Problem
    I have a theme that uses the “wp_verify_nonce” function in many occurrences so i get in a situation that after exactly 24 hours errors starting to appear because the “wp_verify_nonce” returns false and the nonce is invalid.
    In page rules i have configured edge cache ttl to 12 hours.

    Workaround
    In case i purge cache by pressing purge everything button in cloudflare page the site is working perfectly for exact 24 hours.

    Questions:
    1.How can i use page rules along with themes that use the “wp_verify_nonce” function ? (Maybe you should consider this specific setup in next plugin update)
    2.Does cache edge ttl option, purge pages if nothing has changed in the meantime ? (i Believe not)

    Thanks in advance

Viewing 5 replies - 1 through 5 (of 5 total)

  • I think you need to exclude wp_verify_nonce pages with page rules. The existence of the nonce indicates a form is being submitted so even if the nonce succeeded you would still need to purge URL the form affects after right?

    If this doesn’t answer your question can you give me some more information about how the nonce is being used on the theme? I assume its part of the comment form or something right?

    Thanks,
    John

    Thread Starter linusgr

    (@linusgr)

    Hi John,

    You are right my main problem is in a email opt-in form (subscribe form).
    In case it is successful it just prints a message to check your email,after this i have to refresh the page in order to get in the initial state(it works without purging the url).

    After 24 hours of initial purge cache i get error regarding the email opt-in form.

    Is there any other way-workaround except excluding the pages with wp_verify_nonce ?
    Can i have eg a cron job purging specific pages every 24 hours ? is this doable ?

    Thanks for your explanatory answer

    • This reply was modified 8 years, 4 months ago by linusgr.

    Purging the URL every 24 hours might work depending on how its set up. It might cache the first result that hits the origin though which could be an error or a success depending on which user submits.

    You might be better off splitting the process into three pages, one with the sign up form which is cached, and two pages – one for error submissions, and one for success submissions that are purged every 24 hours.

    -John

    Thread Starter linusgr

    (@linusgr)

    Hi John,

    Thanks a LOT for your detailed answer.Everything is clear now about the issue(various aspects it may affect) and will have to experiment a bit to conclude in a final solution.

    Thanks

    P.S Excellent support ??

    Hi,

    No problem! Thanks for using Cloudflare!

    Thanks,
    John

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘wp_verify_nonce and cloudflare incompatibility’ is closed to new replies.