wp_verify_nonce( string $nonce, string|int $action = -1 ): int|false

User Contributed Notes

1. Skip to note 4 content

   Codex 10 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 4You must log in to vote on the helpfulness of this note

   Example
   Verify an nonce created with wp_create_nonce():

   <?php
   // Step A: Create an nonce, and add it as a query var in a link to perform an action.
   $nonce = wp_create_nonce( 'my-nonce' );
   echo "<a href='myplugin.php?_wpnonce={$nonce}'>" . __( 'Save Something', 'textdomain' ) . "</a>";
   ?>

   // Step B: In our file that handles the request, verify the nonce.
   $nonce = $_REQUEST['_wpnonce'];
   if ( ! wp_verify_nonce( $nonce, 'my-nonce' ) ) {
   	die( __( 'Security check', 'textdomain' ) ); 
   } else {
   	// Do stuff here.
   }

   You may also decide to take different actions based on the age of the nonce:

   $nonce = wp_verify_nonce( $nonce, 'my-nonce' );
   switch ( $nonce ) {
   	case 1:
   		echo 'Nonce is less than 12 hours old';
   		break;
   	case 2:
   		echo 'Nonce is between 12 and 24 hours old';
   		break;
   	default:
   		exit( 'Nonce is invalid' );
   }
2. Skip to note 5 content

   WordProof 4 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: 4You must log in to vote on the helpfulness of this note

   Per the WordPress Coding Standards, this is the way as to verify a nonce:

   if ( isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( $_REQUEST['_wpnonce'], 'wpdocs-my-nonce' ) ) {
     
     //do you action
     
   } else {
   
     die( __( 'Security check', 'textdomain' ) ); 
   
   }

   • Source?

     Gerard Reches 1 year ago
3. Skip to note 6 content

   Roy Orbitson 4 years ago

   You must log in to vote on the helpfulness of this noteVote results for this note: -1You must log in to vote on the helpfulness of this note

   This system is not very accurate and the comment about the return values is incorrect. The value 1 means < 12 hours old, but 2 means anywhere from 1 second to < 24 hours old.

   Observe what happens to the nonce tick value over a day:

   local time ~~~ seconds since epoch ~~~ tick
   2021-05-20T00:00:00+03:00 ~~~ 1621458000 ~~~ 37534
   2021-05-20T01:00:00+03:00 ~~~ 1621461600 ~~~ 37534
   2021-05-20T02:00:00+03:00 ~~~ 1621465200 ~~~ 37534
   2021-05-20T03:00:00+03:00 ~~~ 1621468800 ~~~ 37534
   2021-05-20T04:00:00+03:00 ~~~ 1621472400 ~~~ 37535
   2021-05-20T05:00:00+03:00 ~~~ 1621476000 ~~~ 37535
   2021-05-20T06:00:00+03:00 ~~~ 1621479600 ~~~ 37535
   2021-05-20T07:00:00+03:00 ~~~ 1621483200 ~~~ 37535
   2021-05-20T08:00:00+03:00 ~~~ 1621486800 ~~~ 37535
   2021-05-20T09:00:00+03:00 ~~~ 1621490400 ~~~ 37535
   2021-05-20T10:00:00+03:00 ~~~ 1621494000 ~~~ 37535
   2021-05-20T11:00:00+03:00 ~~~ 1621497600 ~~~ 37535
   2021-05-20T12:00:00+03:00 ~~~ 1621501200 ~~~ 37535
   2021-05-20T13:00:00+03:00 ~~~ 1621504800 ~~~ 37535
   2021-05-20T14:00:00+03:00 ~~~ 1621508400 ~~~ 37535
   2021-05-20T15:00:00+03:00 ~~~ 1621512000 ~~~ 37535
   2021-05-20T16:00:00+03:00 ~~~ 1621515600 ~~~ 37536
   2021-05-20T17:00:00+03:00 ~~~ 1621519200 ~~~ 37536
   2021-05-20T18:00:00+03:00 ~~~ 1621522800 ~~~ 37536
   2021-05-20T19:00:00+03:00 ~~~ 1621526400 ~~~ 37536
   2021-05-20T20:00:00+03:00 ~~~ 1621530000 ~~~ 37536
   2021-05-20T21:00:00+03:00 ~~~ 1621533600 ~~~ 37536
   2021-05-20T22:00:00+03:00 ~~~ 1621537200 ~~~ 37536
   2021-05-20T23:00:00+03:00 ~~~ 1621540800 ~~~ 37536

   …and over the boundary of a tick:

   local time ~~~ seconds since epoch ~~~ tick
   2021-05-20T14:59:58+03:00 ~~~ 1621511998 ~~~ 37535
   2021-05-20T14:59:59+03:00 ~~~ 1621511999 ~~~ 37535
   2021-05-20T15:00:00+03:00 ~~~ 1621512000 ~~~ 37535
   2021-05-20T15:00:01+03:00 ~~~ 1621512001 ~~~ 37536
   2021-05-20T15:00:02+03:00 ~~~ 1621512002 ~~~ 37536

   In this example, you can see that a nonce generated at 3pm and verified one second later will return 2 because of the tick change. The ticks do not align with timezones due to their basis in universal time, so nonces will always appear “old” to your code at certain times of the day.

   • You’re right, but it doesn’t matter if the function returns 1 or 2 because this function is use in an if clause and therefore the value is converted to a boolean which will be true for any value that is not 0. The check will only fail if the hashes don’t match.

     mumbomedia 3 years ago