How the WordPress nonce works? How the WordPress nonce works? wordpress wordpress

How the WordPress nonce works?


WP nonce function creates a cryptographic token tied to a specific action, user and user session. It means each user is going to have its own token even for 10000 users.

The nonce is generated by WordPress every 12 hours, but what are the factors that influence and change his life?

It is created via wp_nonce_tick() function which goes throuh a filter nonce_life and can be modified via this filter. wp_nonce_tick docs

If I close the browser I will have the same nonce when I reopen the browser?

If I turn off the computer and reboot, I will have the same nonce?

If I change the browser I will have the same nonce ?

If you are logged in and your session is the same you will have the same nonce token.

If I connect to the Internet with different IP I will have the same nonce?

No. your session will be different and new token will be generated.

If I delete browsing history and cookies I will have the same nonce?

No, your session will be changed since the session is stored in a browser cookie.

You should not rely only on the nonce check. You need also make sure you check current_user_can() function as it is described in the documentation