Can I make my wordpress nonce have a quicker expiration? (via wp_verify_nonce) Can I make my wordpress nonce have a quicker expiration? (via wp_verify_nonce) wordpress wordpress

Can I make my wordpress nonce have a quicker expiration? (via wp_verify_nonce)


I found little documentation on the wordpress nonce.

While the code itself is not very complicated, and there is a way to simply replace the wp_verify_nonce() function, I believe the nonce is used in many places throughout wordpress, and I'm not confident that my replacement will not break other things.

Lacking any helpful suggestions from here or other places, I abandoned the idea of making my nonce expire more quickly and just added my own nonce/timestamp field.

The plugin I am writing generates a nonce and then embeds it in a script block, which is then rendered in the webpage. When the Javascript in the page communicates back to the wordpress admin-ajax.php, it sends back the nonce. Wordpress then verifies the nonce with wp_verify_nonce() and allows the request if the nonce has not expired - either 12 or 24 hours as you wish. This check also verifies the identity of the caller.

What I did was simply generate another nonce, an encrypted timestamp. It gets embedded into the javascript script block, in the same way as the WP nonce. It gets retransmitted in the same way, and verified in a similar manner: I decrypt and check that the timestamp is "recent".
The difference is that my plugin controls the verification so I can set the threshold for "recency".