Skip to content

Instantly share code, notes, and snippets.

@dotherightthing
Created August 15, 2019 09:47
Show Gist options
  • Save dotherightthing/7d19ea2ad436744071c1b12a488aa1a2 to your computer and use it in GitHub Desktop.
Save dotherightthing/7d19ea2ad436744071c1b12a488aa1a2 to your computer and use it in GitHub Desktop.
[Nonce] A nonce is a "number used once" to help protect URLs and forms from certain types of misuse. #security #wordpress

Nonce

Created: 2017.04.12

The one or single occasion; the present reason or purpose (now only in for the nonce).

That will do for the nonce, but we'll need a better answer for the long term.

A value constructed so as to be unique to a particular message in a stream, in order to prevent replay attacks.

In this protocol we use the serial number of the message as a nonce.

A nonce is a "number used once" to help protect URLs and forms from certain types of misuse, malicious or otherwise. WordPress nonces aren't numbers, but are a hash made up of numbers and letters. Nor are they used only once, but have a limited "lifetime" after which they expire. During that time period the same nonce will be generated for a given user in a given context. The nonce for that action will remain the same for that user until that nonce life cycle has completed.

WordPress's security tokens are called "nonces" despite the above noted differences from true nonces, because they serve much the same purpose as nonces do. They help protect against several types of attacks including CSRF, but do not protect against replay attacks because they aren't checked for one-time use. Nonces should never be relied on for authentication or authorization, access control. Protect your functions using current_user_can(), always assume Nonces can be compromised.

  • 6q3rVgtQsiH0820S_2_nonce_url()
  • 6q3rVgtQsiH0820S_2_nonce_field()
  • 6q3rVgtQsiH0820S_2_create_nonce()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment