WordPress not refreshing nonce token on the server WordPress not refreshing nonce token on the server wordpress wordpress

WordPress not refreshing nonce token on the server


What is the time frame on which you are expecting your nonce to change?

On successive refreshes with no other changes the nonce may be identical between page loads. Basically, if you sit there and hit F5 you're going to get the same nonce.

This is by design. Idempotent creation of nonces within a short time frame is required in order to use them for validation.

Once again, basically, if this didn't work this way you'd never be able to verify your nonce. When you created it, the value would be one thing and when you went to re-create it to verify it the value would be another. Validation would always fail.

wp_verify_nonce() may accept a nonce (all else equal) for up to 24 hours (see the WP Codex page). You may need to wait a longer time than that to receive a different nonce.

Other system events that can occur can cause a new nonce to be generated. I have never needed to do this myself but it appears that you may use wp_nonce_tick() to jog this process.

It is possible that either or both wp_create_nonce() (used directly by wp_nonce_field()) and wp_verify_nonce() may have been re-written by some plugin as they are both defined in pluggable.php and intended to be available for override. A well-written WP-aware CDN or other cache solution may do exactly that to persist sessions. I do not know if Super Cache does this or not.

Alternately, and if your system configuration doesn't do so already, you may choose to rewrite those functions yourself. This would be security code and be careful writing security code: the greatest saving grace of open source security code is that it is peer-reviewed and your (new) code will not likely be the same.