WP-API Retrieving Drafts "Cookie nonce is invalid"

user_6076357 0
Viewed 8279

I'm working on a front-end app which ties into wordpress API which sits on a seperate domain.

I'm wanting to retrieve a post draft so when the user clicks "Preview Post" in the wordpress admin panel, it opens my app with the correct content.

I'm loading some Javascript into the WP Admin so I can amend all "Preview Post" links in the admin panel with a wp_nonce token for authentication purposes. This is done using the below snippet, which tweaks the preview post link into for example: http://example.com/blog?p=127&preview=true&auth=16045802ee

function admin_inline_js(){

    // Grab URL 
    echo '
    <script>
    document.addEventListener("DOMContentLoaded", function() {
        // Grab all preview anchors
        var anchors = document.querySelectorAll("a[href*=\'preview=true\']"), i;
        // Loop through and amend to remove the trailing slash, as WP doesnt provide any easy method to achieve this.
        for(i = 0; i < anchors.length; i++) {
            anchors[i].href = anchors[i].href.replace("blog/", "blog") + \'&auth=' . wp_create_nonce('wp_rest') .'\';
        }
    });
    </script>
    ';
}
add_action( 'admin_print_scripts', 'admin_inline_js' );

At http://example.com/blog?p=127&preview=true&auth=16045802ee, the auth parameter is then used to post a request back to wordpress to retrieve the draft with an ID of 127, with a nonce token of 16045802ee. However this isn't working, and I'm getting this response:

object(stdClass)#459 (3) { ["code"]=> string(25) "rest_cookie_invalid_nonce" ["message"]=> string(23) "Cookie nonce is invalid" ["data"]=> object(stdClass)#532 (1) { ["status"]=> int(403) } }

Can anybody spot what I'm doing wrong here? :/

Thanks.

nonce wordpress api php
5 Answers

I debbuged the code and think that the cookie is corrupted.

In the code snippet below, we can see.

// Check the nonce.
$result = wp_verify_nonce( $nonce, 'wp_rest' );

if ( ! $result ) {
    return new WP_Error( 'rest_cookie_invalid_nonce', __( 'Cookie nonce is invalid' ), array( 'status' => 403 ) );
}

For me, this issue has solved when I clear browser cookies for my domain.

user_29123740

I found this Error [{"code":"json_cookie_invalid_nonce","message":"Cookie nonce is invalid"}] after I install WP POS , When the POS page opening time ERROR "forbidden"

after expand the error I get this message [{"code":"json_cookie_invalid_nonce","message":"Cookie nonce is invalid"}]

After little while I found solution. I deactivate newly installed plugins one by one , the i found problem in "Yoast SEO" plugin after deactivation it is POS plugins working fine , then again I activate Yoast SEO plugin no problem it is working fine

user_99601580

You need to add the permission "promote_users" to the POS role. I used "User Role Editor" plugin to do this but you can also add the following to your functions.php:

$pos_role = get_role( 'pos' ); // Or whatever role you want to add it to
$pos_role->add_cap( 'promote_users' );
user_7113550

Something that happened to me and can be useful: assuming that you are properly passing the auth details to API, this error can be triggered if you create the nonce with a not logged user, login in, and checking it after, and that's explained because the nonce is created using user ID.

From file: wp-includes/pluggable.php

function wp_create_nonce( $action = -1 ) {
    $user = wp_get_current_user();
    $uid  = (int) $user->ID;
    if ( ! $uid ) {
        /** This filter is documented in wp-includes/pluggable.php */
        $uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
    }
 
    $token = wp_get_session_token();
    $i     = wp_nonce_tick();
 
    return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
}
user_15361590
Related