WordPress nonce not verifying WooCommerce cart action
In order to make product pages cacheable WooCommerce sessions are not created until a cart is created.1,2
WooCommerce overrides one of the nonce parameters with a value which changes based on whether or not a WooCommerce session has been created.3,4
When you create the nonce for a new user with no cart and no session the nonce is calculated with one set of inputs. When you check the nonce after an item has been added to the cart the check value is generated with a different set of inputs because the WooCommerce session now exists. This causes a different nonce value to be generated and the nonce check against the old nonce value to fail.
One workaround is to proactively create the WooCommerce session before creating the nonces. Note this could impact how your site is cached.
- https://github.com/woocommerce/woocommerce/issues/4920#issuecomment-35846419
- https://mikejolley.com/2013/12/20/problems-with-cart-sessions-and-woocommerce/
- https://developer.wordpress.org/reference/functions/wp_create_nonce/
- https://github.com/woocommerce/woocommerce/blob/c16acc6b5104acb0ed082e7df1c63dfd77598459/includes/class-wc-session-handler.php#L224