Nonce verification in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a WordPress nonce verification fails?

Consider a WordPress plugin that uses check_admin_referer('my_action') to verify a nonce. What is the typical behavior if the nonce is invalid or missing?

A The function triggers a WordPress error and stops script execution immediately.

B The function returns false and the script continues without interruption.

C The function logs the error but allows the script to continue running.

D The function automatically regenerates a new nonce and retries verification.

💡 Hint

Think about how WordPress protects admin actions from unauthorized access.

The check_admin_referer() function verifies the nonce and if it fails, it triggers a WordPress error and stops the script execution to prevent unauthorized actions.

📝 Syntax

intermediate

Which code snippet correctly verifies a nonce in a WordPress AJAX handler?

You want to verify a nonce sent via POST in your AJAX handler function. Which snippet correctly checks the nonce named 'my_nonce'?

A if (check_admin_referer('my_nonce', 'my_action')) { wp_die('Invalid nonce'); }

B if (!check_ajax_referer('my_action', 'my_nonce', false)) { wp_die('Invalid nonce'); }

C if (!wp_verify_nonce($_POST['my_nonce'], 'my_action')) { wp_die('Invalid nonce'); }

D if (!wp_verify_nonce('my_action', $_POST['my_nonce'])) { wp_die('Invalid nonce'); }

💡 Hint

Remember the order of parameters for wp_verify_nonce and how to handle failure.

wp_verify_nonce() takes the nonce value first, then the action string. It returns false if invalid, so the condition negates it to trigger wp_die().

❓ state_output

advanced

What is the output of this nonce verification code snippet?

Given the following code in a WordPress plugin, what will be the output if the nonce is valid?

Wordpress

<?php
if (isset($_POST['my_nonce']) && wp_verify_nonce($_POST['my_nonce'], 'save_data')) {
  echo 'Nonce verified';
} else {
  echo 'Nonce failed';
}
?>

A Nonce failed

B Nonce verified

C PHP Warning: Undefined index 'my_nonce'

D No output

💡 Hint

Check the condition and what happens when the nonce is valid.

If the nonce is set and valid, the code echoes 'Nonce verified'. Otherwise, it echoes 'Nonce failed'.

🔧 Debug

advanced

Why does this nonce verification always fail?

Identify the reason why the nonce verification fails every time in this code snippet:

Wordpress

<?php
if (!wp_verify_nonce('save_data', $_POST['my_nonce'])) {
  wp_die('Invalid nonce');
}
?>

A The parameters to wp_verify_nonce are reversed; nonce value should be first.

B The nonce action string 'save_data' is missing from the POST data.

C wp_die() is called incorrectly without an error message.

D The nonce is not generated before verification.

💡 Hint

Check the order of parameters for wp_verify_nonce.

The first parameter to wp_verify_nonce() must be the nonce value, and the second is the action string. Reversing them causes verification to fail.

🧠 Conceptual

expert

Why is nonce verification important in WordPress forms?

Choose the best explanation for why WordPress uses nonce verification in forms and AJAX requests.

A To encrypt user data before sending it to the server for security.

B To speed up form submissions by caching nonce values.

C To validate user input formats like email and phone numbers.

D To prevent Cross-Site Request Forgery (CSRF) attacks by ensuring requests come from trusted sources.

💡 Hint

Think about what kind of attacks nonce verification protects against.

Nonces in WordPress protect against CSRF attacks by verifying that requests come from legitimate users and not attackers.

Practice

1. What is the main purpose of using a nonce in WordPress?

easy

A. To create database backups automatically

B. To speed up page loading times

C. To store user preferences

D. To protect against unauthorized actions and CSRF attacks

Solution

1. Step 1: Understand what a nonce is

   A nonce is a security token used to verify requests are intentional and authorized.

2. Step 2: Identify nonce purpose in WordPress

   WordPress uses nonces to protect against CSRF (Cross-Site Request Forgery) attacks by verifying actions.

3. Final Answer:

   To protect against unauthorized actions and CSRF attacks -> Option D

4. Quick Check:

   Nonce = Security token for authorization [OK]

Hint: Nonce = security check token to stop bad requests [OK]

Common Mistakes:

• Thinking nonce speeds up performance
• Confusing nonce with user data storage
• Assuming nonce creates backups

2. Which function is used to verify a nonce in WordPress?

easy

A. wp_create_nonce()

B. wp_verify_nonce()

C. check_nonce()

D. nonce_verify()

Solution

1. Step 1: Recall nonce creation function

   wp_create_nonce() is used to create a nonce, not verify it.

2. Step 2: Identify the correct verification function

   wp_verify_nonce() is the official WordPress function to check if a nonce is valid.

3. Final Answer:

   wp_verify_nonce() -> Option B

4. Quick Check:

   Verify nonce = wp_verify_nonce() [OK]

Hint: Verify nonce starts with 'wp_verify_' [OK]

Common Mistakes:

• Using wp_create_nonce() to verify
• Assuming check_nonce() is a WordPress function
• Mixing function names

3. What will the following code output if the nonce is invalid?

if ( ! wp_verify_nonce($_POST['my_nonce'], 'my_action') ) {
  echo 'Invalid nonce';
} else {
  echo 'Nonce verified';
}

medium

A. Nonce verified

B. PHP error: undefined index

C. Invalid nonce

D. No output

Solution

1. Step 1: Understand wp_verify_nonce behavior

   wp_verify_nonce returns false if the nonce is invalid or missing.

2. Step 2: Analyze the if condition

   If wp_verify_nonce returns false, the condition !false is true, so 'Invalid nonce' is echoed.

3. Final Answer:

   Invalid nonce -> Option C

4. Quick Check:

   Invalid nonce triggers message 'Invalid nonce' [OK]

Hint: Invalid nonce means wp_verify_nonce returns false [OK]

Common Mistakes:

• Assuming invalid nonce prints 'Nonce verified'
• Ignoring the negation (!) in the if condition
• Expecting no output on invalid nonce

4. Identify the error in this nonce verification code snippet:

if ( wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  // process data
} else {
  wp_die('Security check failed');
}

medium

A. No error, code is correct

B. Missing negation (!) before wp_verify_nonce

C. Using wp_die() instead of wp_redirect()

D. Incorrect nonce action string 'save_data'

Solution

1. Step 1: Understand wp_verify_nonce return values

   wp_verify_nonce() returns truthy integer (1 or 2) if valid or previously used, false if invalid/expired.

2. Step 2: Analyze the code logic

   if (wp_verify_nonce()) processes if truthy (valid), else wp_die() if falsy (invalid). Correct logic.

3. Final Answer:

   No error, code is correct -> Option A

4. Quick Check:

   if (wp_verify_nonce()) process else die [OK]

Hint: if(wp_verify_nonce()) process; else die works [OK]

Common Mistakes:

• Thinking negation (!) is required
• Assuming wp_die() is wrong here
• Changing action string unnecessarily

5. You want to secure an AJAX request in WordPress using a nonce. Which sequence correctly implements nonce creation and verification?

hard

A. Create nonce with wp_create_nonce('ajax_action') in PHP; send it via AJAX; verify with wp_verify_nonce($_POST['nonce'], 'ajax_action')

B. Create nonce with wp_verify_nonce('ajax_action'); send it via AJAX; verify with wp_create_nonce($_POST['nonce'], 'ajax_action')

C. Create nonce with wp_create_nonce('ajax_action') in JavaScript; verify with wp_verify_nonce($_GET['nonce'], 'ajax_action')

D. Create nonce with wp_create_nonce('ajax_action') in PHP; no need to verify on AJAX request

Solution

1. Step 1: Understand nonce creation and usage

   Nonce must be created in PHP using wp_create_nonce with an action name.

2. Step 2: Verify nonce on AJAX request

   Nonce sent via AJAX (usually POST) must be verified in PHP using wp_verify_nonce with the same action.

3. Final Answer:

   Create nonce with wp_create_nonce('ajax_action') in PHP; send it via AJAX; verify with wp_verify_nonce($_POST['nonce'], 'ajax_action') -> Option A

4. Quick Check:

   Nonce create in PHP, verify in PHP with same action [OK]

Hint: Create nonce in PHP, verify in PHP with same action [OK]

Common Mistakes:

• Trying to create nonce in JavaScript
• Mixing up create and verify functions
• Skipping verification on AJAX requests