Wordpress Nonces

Whoosh! Thanks for such an in depth response Kevin.

So basically a nonce (although via a different approach) protects a site that has forms/user input much like that of htmlspecialchars? I'm going to have to read this again in the morning to fully grasp what you have explained here to me. I think that I get the concept though.

How do I generate a nonce in a form field &/or create/delete action on Wordpress? Is there a good place to learn about this more in depth?

Thanks again:-)

It does protect a site but it does it differently tan htmlspecialchars. That's really for sanatizing input against someone submitting code in an input box.

A nonce keeps someone else, submitting a form from their site, to yours as example. This kind of attack is called a cross-site request forgery. WP just calls them a nonce. Again, in Rails they are simply called a csrf token, exact some thing.

To use, first you want to create the nonce using wp_create_nonce when you are loading the page that has the form.

https://codex.wordpress.org/Function_Reference/wp_create_nonce

There are examples on how you can build a url to use a get request to include the nonce on that page.

If it's in the form, the nonce should be in a hidden field in the form. You can add that using the wp_nonce_field. There are optional arguments which I suggest you follow the codex's advice and use the optional arguments as they indicate.

https://codex.wordpress.org/Function_Reference/wp_nonce_field

This would create a field in your form like this:

<form action="form.php" method="POST">
<input type="hidden" value="kdfdjhIU8DKHj3dkf7dFJ2ddfD9kdre3kdhjfijEfg">
<input type="text" name="name">
<input type="email" name="email">
<input type="text" name="location">
<input type="submit" value="Submit">
</form>

My form is super simplified, and hopefully my syntax is right from memory, but you can what that nonce field might look for instance.

Finally, we get a form submit, we first check for the form submit, and than check the nonce. When your're checking the form, you can just see if the nonce's match using the wp_verify_nonce function.

That's the general overall picture.

This is the first time I have a clear image of nonce.