API Fetch: refresh nonces as soon as they expire, then fetch again #16683

ellatrix · 2019-07-19T15:00:33Z

Description

Currently, nonces are refresh through the Heartbeat API, but it requires a valid nonce. When you leave a post open and come back to it the next day (during which time the heartbeat may have stopped), the nonce cannot be refreshed.

Since a simple authenticated request is enough to get a new nonce elsewhere (like a full page reload), we can just create an endpoint with admin-ajax.php to get a new nonce. We CANNOT use the REST API itself because of CORS, but we can create a separate endpoint without CORS.

I updated the API Fetch package to refresh a nonce when the REST API sends a nonce error code. Once a new nonce is obtained, the request is remade. The user wouldn't notice a thing. :)

Notice that with this technique, the nonce lifetime could even be reduced for increased security, without affecting the user experience!

How has this been tested?

Install the e2e test plugin that sets the nonce lifetime to 5 seconds. Create a new post. Wait 5 seconds, then add some text and try to save. Saving should work. Open the console and notice that there is one 403 status error logged.

Screenshots

Types of changes

Checklist:

My code is tested.
My code follows the WordPress code style.
My code follows the accessibility standards.
My code has proper inline documentation.
I've included developer documentation if appropriate.

ellatrix · 2019-07-19T15:01:25Z

lib/client-assets.php

-				)
-			),
-			( wp_installing() && ! is_multisite() ) ? '' : wp_create_nonce( 'wp_rest' )
+			'wp.apiFetch.nonceMiddleware = wp.apiFetch.createNonceMiddleware( "%s" );' .


I left createNonceMiddleware alone as core is using it.

aduth

Curious to have feedback from the REST API team on this one.

aduth · 2019-07-29T13:32:03Z

packages/api-fetch/src/index.js

+					return reject( error );
+				}
+
+				// If the nonce is invalid, refresh it and try again.


Can / should this be part of a new or existing middleware?

Perhaps. I didn't really find a good way to put the promise callback in the middleware for creating a request. I guess there should be two kinds of middleware then? One for creating the request and one for processing the response?

packages/e2e-tests/specs/plugins/nonce.test.js

gutenberg.php

TimothyBJacobs · 2019-07-29T16:41:19Z

Curious to have feedback from the REST API team on this one.

I'll make sure to bring this ticket up at the next office hours.

ellatrix · 2019-07-30T07:46:04Z

@TimothyBJacobs Thanks!

aduth · 2019-07-30T13:37:22Z

Related: https://core.trac.wordpress.org/ticket/37569#comment:24

ellatrix · 2019-08-06T14:06:51Z

@TimothyBJacobs @kadamwhite Any news on this? :)

kadamwhite · 2019-08-06T18:26:28Z

@ellatrix Thanks for the bump :) My bad.

I think this makes sense. I'd be very hesitant to change or relax the authentication rules for any route within /wp-json, so I like using admin-ajax for getting the new nonce; the approach you're using feels safest.

My only concern would be to ensure we're guarded against any situation where the admin-ajax endpoint could be exploited by an unauthorized user to get a nonce/cookie combo they could use for mischief. I believe this is probably well in hand given normal admin-ajax authentication rules, I'm just much less familiar with those than I am the REST API! :)

As for whether this should be middleware, I'm impartial. I feel it should be possible to utilize middleware for this, but apiFetch is also a very WordPress-oriented request library so I've no problem supporting this behavior as part of the core request chain logic.

kadamwhite · 2019-08-06T18:28:20Z

lib/client-assets.php

+			'wp.apiFetch.use( wp.apiFetch.nonceMiddleware );' .
+			'wp.apiFetch.nonceEndpoint = "%s";',
+			( wp_installing() && ! is_multisite() ) ? '' : wp_create_nonce( 'wp_rest' ),
+			admin_url( 'admin-ajax.php?action=gutenberg_rest_nonce' )


the nonce lifetime could even be reduced for increased security, without affecting the user experience!

This would only be true if we assume all libraries are using apiFetch, or at minimum using a similar base mechanism for refreshing nonces. Perhaps it would be better to drop the gutenberg_ prefix here to encourage consistent use of this approach by plugins writing admin UI that uses alternative HTTP transports?

My intention is to drop the gutenberg_ prefix, but only when the PHP code gets merged with core. I'm also fine dropping it here, but this is still a plugin, not core.

This would only be true if we assume all libraries are using apiFetch, or at minimum using a similar base mechanism for refreshing nonces.

That's right. It's currently also not possible to change the lifetime of specific nonces I think. That would be cool. :)

I just wanted to highlight the possibility, but yes, right now, that's unrealistic.

ellatrix · 2019-08-06T19:32:47Z

@kadamwhite Thanks for the review. So if I understand you correctly, you have no objections?

I also don't really care about the middleware. I can do it if people like, or we can just do it when the need arises.

kadamwhite

if I understand you correctly, you have no objections?

Sorry for being vague; yes, I approve of the plan :) haven’t tested it locally but the code and direction sound great so I’ll add my +1 here

ellatrix · 2019-08-09T17:34:54Z

Thanks for the review @kadamwhite! Let's iterate if we see a need for response middleware. This is a great step forward in ensure the user doesn't lose their content. :)

ellatrix · 2019-08-09T17:36:15Z

I'll help out if this needs some renaming/adjustments on the PHP side when merging into core.

…16683) * API Fetch: refresh nonces as soon as they expired, then fetch again * Use exit() * Fix PHP linting errors

youknowriad · 2019-09-13T19:47:59Z

@ellatrix do you know if this change have been packported into Core (the php change) or whether it's included in the last patch here https://core.trac.wordpress.org/ticket/47843

cc @gziolo

gziolo · 2019-09-14T15:59:54Z

It's not backported:
https://github.com/WordPress/wordpress-develop/blob/bc6f11decdc4149b8616bd11c59c75189944b762/src/wp-includes/script-loader.php#L542-L554

@ellatrix @kadamwhite - should it be replicated as is in WordPress core?

ellatrix · 2019-09-15T10:26:40Z

I'll try to look today, if not tomorrow (Monday).

ellatrix · 2019-09-15T16:54:52Z

@gziolo The package hasn't been updated yet in core so it wouldn't have been adjusted it the core repository yet.

ellatrix · 2019-09-15T17:02:49Z

I'll update you patch https://core.trac.wordpress.org/ticket/47843

gziolo · 2019-09-15T18:51:42Z

I'll update you patch https://core.trac.wordpress.org/ticket/47843

Awesome, thank you for your help 💯

This is a follow up to #47843, implementing a PHP endpoint and inline scripts after the editor package updates. The action was originally added in WordPress/gutenberg#16683. Fixes #48076. git-svn-id: https://develop.svn.wordpress.org/trunk@46253 602fd350-edb4-49c9-b593-d223f7449a82

This is a follow up to #47843, implementing a PHP endpoint and inline scripts after the editor package updates. The action was originally added in WordPress/gutenberg#16683. Fixes #48076. Built from https://develop.svn.wordpress.org/trunk@46253 git-svn-id: http://core.svn.wordpress.org/trunk@46065 1a063a9b-81f0-0310-95a4-ce76da25c4cd

This is a follow up to #47843, implementing a PHP endpoint and inline scripts after the editor package updates. The action was originally added in WordPress/gutenberg#16683. Fixes #48076. Built from https://develop.svn.wordpress.org/trunk@46253 git-svn-id: https://core.svn.wordpress.org/trunk@46065 1a063a9b-81f0-0310-95a4-ce76da25c4cd

This is a follow up to #47843, implementing a PHP endpoint and inline scripts after the editor package updates. The action was originally added in WordPress/gutenberg#16683. Fixes #48076. git-svn-id: http://develop.svn.wordpress.org/trunk@46253 602fd350-edb4-49c9-b593-d223f7449a82

ellatrix added the [Package] API fetch /packages/api-fetch label Jul 19, 2019

ellatrix requested review from aduth, ajitbohra, gziolo, mmtr, nerrad, ntwb, talldan, TimothyBJacobs and youknowriad as code owners July 19, 2019 15:00

ellatrix commented Jul 19, 2019

View reviewed changes

ellatrix added this to the Gutenberg 6.2 milestone Jul 24, 2019

aduth reviewed Jul 29, 2019

View reviewed changes

gziolo removed this from the Gutenberg 6.2 milestone Jul 30, 2019

TimothyBJacobs added the REST API Interaction Related to REST API label Aug 6, 2019

kadamwhite reviewed Aug 6, 2019

View reviewed changes

ellatrix added this to the Gutenberg 6.3 milestone Aug 6, 2019

kadamwhite approved these changes Aug 6, 2019

View reviewed changes

ellatrix force-pushed the try/better-nonce-refresh branch from 6f454ac to 240815f Compare August 7, 2019 09:24

ellatrix added 3 commits August 8, 2019 12:43

API Fetch: refresh nonces as soon as they expired, then fetch again

04d8ae1

Use exit()

087fe0b

Fix PHP linting errors

c62b839

ellatrix force-pushed the try/better-nonce-refresh branch from 240815f to c62b839 Compare August 8, 2019 10:43

ellatrix merged commit be95231 into master Aug 9, 2019

ellatrix deleted the try/better-nonce-refresh branch August 9, 2019 17:35

ellatrix changed the title ~~API Fetch: refresh nonces as soon as they expired, then fetch again~~ API Fetch: refresh nonces as soon as they expire, then fetch again Aug 15, 2019

gziolo pushed a commit that referenced this pull request Aug 29, 2019

API Fetch: refresh nonces as soon as they expired, then fetch again (#…

5cb3db0

…16683) * API Fetch: refresh nonces as soon as they expired, then fetch again * Use exit() * Fix PHP linting errors

gziolo pushed a commit that referenced this pull request Aug 29, 2019

API Fetch: refresh nonces as soon as they expired, then fetch again (#…

925426b

…16683) * API Fetch: refresh nonces as soon as they expired, then fetch again * Use exit() * Fix PHP linting errors

youknowriad added the Backport to WP 6.6 Beta/RC Pull request that needs to be backported to the WordPress major release that's currently in beta label Sep 13, 2019

gziolo mentioned this pull request Oct 8, 2019

Block Directory: Convert it to UI Plugin to avoid bundling into Core #17576

Merged

jorgefilipecosta removed the Backport to WP 6.6 Beta/RC Pull request that needs to be backported to the WordPress major release that's currently in beta label Feb 4, 2020

Mamaduka mentioned this pull request Aug 10, 2022

If WordPress user session expires on post edit page, Gutenberg autosave continues resulting in 403s #13509

Open

calvinalkan mentioned this pull request May 18, 2023

Fetch a new WordPress Nonce if the current one is expired. FluentCRM/fluent-crm#28

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

API Fetch: refresh nonces as soon as they expire, then fetch again #16683

API Fetch: refresh nonces as soon as they expire, then fetch again #16683

ellatrix commented Jul 19, 2019 •

edited

Loading

ellatrix Jul 19, 2019 •

edited

Loading

aduth left a comment

aduth Jul 29, 2019

ellatrix Jul 30, 2019

TimothyBJacobs commented Jul 29, 2019

ellatrix commented Jul 30, 2019

aduth commented Jul 30, 2019

ellatrix commented Aug 6, 2019

kadamwhite commented Aug 6, 2019

kadamwhite Aug 6, 2019

ellatrix Aug 6, 2019

ellatrix Aug 6, 2019

ellatrix Aug 6, 2019

ellatrix commented Aug 6, 2019

kadamwhite left a comment

ellatrix commented Aug 9, 2019

ellatrix commented Aug 9, 2019

youknowriad commented Sep 13, 2019

gziolo commented Sep 14, 2019

ellatrix commented Sep 15, 2019

ellatrix commented Sep 15, 2019

ellatrix commented Sep 15, 2019

gziolo commented Sep 15, 2019

API Fetch: refresh nonces as soon as they expire, then fetch again #16683

API Fetch: refresh nonces as soon as they expire, then fetch again #16683

Conversation

ellatrix commented Jul 19, 2019 • edited Loading

Description

How has this been tested?

Screenshots

Types of changes

Checklist:

ellatrix Jul 19, 2019 • edited Loading

Choose a reason for hiding this comment

aduth left a comment

Choose a reason for hiding this comment

aduth Jul 29, 2019

Choose a reason for hiding this comment

ellatrix Jul 30, 2019

Choose a reason for hiding this comment

TimothyBJacobs commented Jul 29, 2019

ellatrix commented Jul 30, 2019

aduth commented Jul 30, 2019

ellatrix commented Aug 6, 2019

kadamwhite commented Aug 6, 2019

kadamwhite Aug 6, 2019

Choose a reason for hiding this comment

ellatrix Aug 6, 2019

Choose a reason for hiding this comment

ellatrix Aug 6, 2019

Choose a reason for hiding this comment

ellatrix Aug 6, 2019

Choose a reason for hiding this comment

ellatrix commented Aug 6, 2019

kadamwhite left a comment

Choose a reason for hiding this comment

ellatrix commented Aug 9, 2019

ellatrix commented Aug 9, 2019

youknowriad commented Sep 13, 2019

gziolo commented Sep 14, 2019

ellatrix commented Sep 15, 2019

ellatrix commented Sep 15, 2019

ellatrix commented Sep 15, 2019

gziolo commented Sep 15, 2019

ellatrix commented Jul 19, 2019 •

edited

Loading

ellatrix Jul 19, 2019 •

edited

Loading