wp_verify_nonce() WordPress Function
The wp_verify_nonce() function is a security measure that is used to verify the authenticity of a request. This function is typically used to protect against cross-site request forgery (CSRF) attacks. The wp_verify_nonce() function takes two arguments: the nonce to be verified, and the action to be checked. If the nonce is valid and the action is authorized, the function will return true. Otherwise, the function will return false.
wp_verify_nonce( string $nonce, string|int $action = -1 ) #
Verifies that a correct security nonce was used with time limit.
Description
A nonce is valid for 24 hours (by default).
Parameters
- $nonce
(string)(Required)Nonce value that was used for verification, usually via a form field.
- $action
(string|int)(Optional)Should give context to what is taking place and be the same when nonce was created.
Default value: -1
Return
(int|false) 1 if the nonce is valid and generated between 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago. False if the nonce is invalid.
More Information
The function is used to verify the nonce sent in the current request usually accessed by the $_REQUEST PHP variable.
Nonces should never be relied on for authentication or authorization, access control. Protect your functions using current_user_can(), always assume Nonces can be compromised.
Source
File: wp-includes/pluggable.php
function wp_verify_nonce( $nonce, $action = -1 ) { $nonce = (string) $nonce; $user = wp_get_current_user(); $uid = (int) $user->ID; if ( ! $uid ) { /** * Filters whether the user who generated the nonce is logged out. * * @since 3.5.0 * * @param int $uid ID of the nonce-owning user. * @param string $action The nonce action. */ $uid = apply_filters( 'nonce_user_logged_out', $uid, $action ); } if ( empty( $nonce ) ) { return false; } $token = wp_get_session_token(); $i = wp_nonce_tick(); // Nonce generated 0-12 hours ago. $expected = substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 ); if ( hash_equals( $expected, $nonce ) ) { return 1; } // Nonce generated 12-24 hours ago. $expected = substr( wp_hash( ( $i - 1 ) . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 ); if ( hash_equals( $expected, $nonce ) ) { return 2; } /** * Fires when nonce verification fails. * * @since 4.4.0 * * @param string $nonce The invalid nonce. * @param string|int $action The nonce action. * @param WP_User $user The current user object. * @param string $token The user's session token. */ do_action( 'wp_verify_nonce_failed', $nonce, $action, $user, $token ); // Invalid nonce. return false; }
Expand full source codeCollapse full source codeView on TracView on GitHub
Changelog
Version | Description |
---|---|
2.0.3 | Introduced. |