阐述 WordPress `wp_create_nonce()` 函数的源码：如何通过 `tick` 和用户 ID 生成 `Nonce` 令牌。

Alright folks, settle down, settle down! Welcome, welcome to Nonce-ville! Today, we’re diving deep into the magical world of WordPress security, specifically, the wp_create_nonce() function. Buckle up, because we’re about to unravel the secrets of how WordPress generates those seemingly random tokens that protect your forms and actions from the evil forces of Cross-Site Request Forgery (CSRF).

Think of me as your friendly neighborhood code wizard, here to demystify the incantations that power your WordPress site. Let’s get started, shall we?

What is a Nonce anyway? (A Quick Refresher)

Before we jump into the code, let’s make sure everyone’s on the same page. A nonce, short for "number used once," is a cryptographic token designed to prevent CSRF attacks. Essentially, it’s a unique, unpredictable value that’s tied to a specific user, action, and time window.

Imagine you’re ordering pizza online. Without a nonce, a malicious website could trick your browser into sending a pizza order to your favorite place, all without your knowledge. A nonce acts like a secret handshake, verifying that the request is legitimate and originated from your actual pizza-ordering session.

The wp_create_nonce() Function: Our Journey Begins

The wp_create_nonce() function is the heart of our story. It’s responsible for generating these security tokens. You’ll find it defined in wp-includes/pluggable.php. Let’s take a look at its basic structure:

function wp_create_nonce( $action = -1 ) {
    $user = wp_get_current_user();
    $uid = (int) $user->ID;
    $token = wp_get_session_token();

    $i = wp_nonce_tick();

    return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
}

Okay, let’s break this down step by step. It’s less scary than it looks, I promise!

1. $action = -1: The function accepts an optional $action parameter. This is a string (or an integer that will be cast to a string) that identifies the specific action you’re trying to protect. If you omit it, it defaults to -1. Think of it as labeling the pizza order: "Pepperoni," "Veggie," etc. Using specific actions makes your nonces more secure, as they’re tied to a particular task.

2. $user = wp_get_current_user();: This retrieves the current logged-in user object. If no user is logged in, it returns a user object with ID 0.

3. $uid = (int) $user->ID;: We extract the user’s ID and cast it to an integer. This is a crucial part of the nonce generation, as it ties the nonce to a specific user. Only that user can use the nonce.

4. $token = wp_get_session_token();: This fetches the user’s session token. This token acts as a further layer of security to ensure the nonce is tied to the user’s current session. If the session is compromised, the nonce becomes invalid.

5. $i = wp_nonce_tick();: This is where things get a little more interesting. The wp_nonce_tick() function returns a "tick" value, which is an integer representing the number of 12-hour intervals that have passed since the WordPress installation. This is the time component of the nonce, making it valid only for a limited time.

6. return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );: This is the grand finale! It’s where the magic happens. Let’s dissect it:

   • $i . '|' . $action . '|' . $uid . '|' . $token: This concatenates the tick value, action, user ID, and session token into a single string, separated by pipes (|). This string forms the basis for our nonce.
   • wp_hash( ..., 'nonce' ): This applies a hashing algorithm (usually MD5, but can be filtered) to the concatenated string, using ‘nonce’ as the algorithm identifier. Hashing transforms the string into a fixed-length, seemingly random string. This provides protection as it is difficult to reverse the hash to find the original values.
   • substr( ..., -12, 10 ): Finally, this extracts a 10-character substring from the end of the hashed string. This substring is our final nonce value. Taking the last 10 characters increases the unpredictability.

Diving Deeper: The wp_nonce_tick() Function

As you can see, wp_nonce_tick() is crucial to the entire process. Let’s take a closer look at its definition, also found in wp-includes/pluggable.php:

function wp_nonce_tick() {
    /**
     * Filters the lifespan of the nonce in seconds.
     *
     * @since 4.5.0
     *
     * @param int $lifespan Nonce lifespan in seconds. Default 12 hours.
     */
    $valid_nonce_time_slice = apply_filters( 'nonce_life', DAY_IN_SECONDS / 2 );

    return ceil( time() / $valid_nonce_time_slice );
}

Here’s what’s going on:

1. $valid_nonce_time_slice = apply_filters( 'nonce_life', DAY_IN_SECONDS / 2 );: This line calculates the lifespan of the nonce. DAY_IN_SECONDS is a constant defined as 60 * 60 * 24 (86400 seconds). So, DAY_IN_SECONDS / 2 is 43200 seconds, or 12 hours. The apply_filters() function allows developers to modify this lifespan using the nonce_life filter. This is a great way to customize the security of your nonces.

2. return ceil( time() / $valid_nonce_time_slice );: This is the core of the function.

   • time() returns the current Unix timestamp (the number of seconds since January 1, 1970).
   • We divide the current timestamp by the $valid_nonce_time_slice (12 hours).
   • ceil() rounds the result up to the nearest integer.

The result is an integer that represents the current 12-hour "tick." This tick value changes every 12 hours, which means that nonces generated with a specific tick value will only be valid for that 12-hour period.

Putting It All Together: An Example

Let’s illustrate this with a concrete example. Suppose the following:

• Current Unix timestamp: 1678886400 (March 15, 2023, 00:00:00 GMT)
• $valid_nonce_time_slice: 43200 (12 hours in seconds)
• User ID: 5
• Action: "edit_post"
• Session Token: "unique_session_token"

Here’s how the nonce would be generated:

1. wp_nonce_tick():

   • 1678886400 / 43200 = 38862.86…
   • ceil(38862.86…) = 38863
   • So, $i (the tick value) is 38863.

2. Concatenation:

   • $i . '|' . $action . '|' . $uid . '|' . $token becomes: 38863|edit_post|5|unique_session_token

3. Hashing:

   • wp_hash( '38863|edit_post|5|unique_session_token', 'nonce' ) (let’s pretend the result is): e7f4c6a2b8d9e0a1c3b5d7f9e2a4b1c8

4. Substring:

   • substr( 'e7f4c6a2b8d9e0a1c3b5d7f9e2a4b1c8', -12, 10 ) becomes: a4b1c8

Therefore, the generated nonce would be a4b1c8.

The Magic Behind the Scenes: The wp_hash() Function

You might be wondering about the wp_hash() function. It’s responsible for creating the hash, and its behavior can be customized using filters. Here’s a simplified representation of what wp_hash() does:

function wp_hash( $data, $scheme = 'auth' ) {
    static $wp_hasher;

    if ( empty( $wp_hasher ) ) {
        require_once ABSPATH . 'wp-includes/class-phpass.php';
        $wp_hasher = new PasswordHash( 8, true );
    }

    return $wp_hasher->HashPassword( $data );
}

In essence, it uses the PasswordHash class (from the portable PHP password hashing framework, or phpass) to generate a secure hash of the input data. The PasswordHash class handles the underlying cryptographic operations. While the actual hashing algorithm used might vary based on server configuration and WordPress version, it generally involves a strong hashing algorithm like bcrypt (if available) or a fallback to MD5.

The Role of wp_verify_nonce()

Of course, generating a nonce is only half the battle. You also need to verify it when the user submits the form or performs the action. This is where the wp_verify_nonce() function comes in. It essentially performs the same steps as wp_create_nonce(), but instead of generating a new nonce, it calculates what the nonce should be based on the provided action, user ID, and tick value. If the calculated nonce matches the nonce submitted by the user, the verification succeeds.

Code Examples: Putting it into Practice

Let’s look at some practical examples of how to use wp_create_nonce() and wp_verify_nonce():

Example 1: Protecting a Form Submission

<?php
// In your form:
$nonce = wp_create_nonce( 'my_form_action' );
?>
<form method="post" action="">
    <input type="hidden" name="my_nonce_field" value="<?php echo esc_attr( $nonce ); ?>">
    <input type="submit" value="Submit">
</form>

<?php
// In your form processing code:
if ( isset( $_POST['my_nonce_field'] ) && wp_verify_nonce( $_POST['my_nonce_field'], 'my_form_action' ) ) {
    // Process the form data
    echo "Form submission successful!";
} else {
    // Handle the error
    echo "Nonce verification failed!";
}
?>

Explanation:

1. We generate a nonce using wp_create_nonce( 'my_form_action' ), where 'my_form_action' is a unique identifier for this specific form.
2. We embed the nonce in a hidden field named my_nonce_field in the form.
3. When the form is submitted, we check if the my_nonce_field is set and then use wp_verify_nonce() to verify the nonce against the 'my_form_action'.
4. If the verification succeeds, we process the form data. Otherwise, we display an error message.

Example 2: Protecting an AJAX Action

<?php
// In your PHP code (e.g., in your theme's functions.php file):

add_action( 'wp_ajax_my_ajax_action', 'my_ajax_callback' ); // For logged-in users
add_action( 'wp_ajax_nopriv_my_ajax_action', 'my_ajax_callback' ); // For non-logged-in users

function my_ajax_callback() {
    check_ajax_referer( 'my_ajax_nonce', 'security' ); // Verify the nonce

    // Process the AJAX request
    $response = array( 'success' => true, 'message' => 'AJAX action successful!' );
    wp_send_json( $response );

    wp_die(); // Required to terminate AJAX processing properly
}

// In your JavaScript code:
jQuery(document).ready(function($) {
    var data = {
        'action': 'my_ajax_action',
        'security': '<?php echo wp_create_nonce( "my_ajax_nonce" ); ?>' // Generate the nonce
    };

    $.post(ajaxurl, data, function(response) {
        if (response.success) {
            alert(response.message);
        } else {
            alert('AJAX action failed!');
        }
    });
});
?>

Explanation:

1. We register an AJAX action using add_action(). We register both wp_ajax_my_ajax_action and wp_ajax_nopriv_my_ajax_action to handle both logged-in and non-logged-in users.
2. In the AJAX callback function (my_ajax_callback()), we use check_ajax_referer() to verify the nonce. check_ajax_referer() is a wrapper around wp_verify_nonce() specifically designed for AJAX requests. It takes two arguments: the action name ('my_ajax_nonce') and the name of the POST variable containing the nonce ('security').
3. In the JavaScript code, we generate a nonce using wp_create_nonce( "my_ajax_nonce" ) and pass it as the security parameter in the AJAX request.
4. If the nonce verification succeeds, the AJAX action is processed. Otherwise, an error is returned.

Security Considerations and Best Practices

• Use Specific Actions: Always use specific action names for your nonces. Avoid using generic actions like 'submit' or 'update'. The more specific the action, the harder it is for an attacker to reuse a nonce.
• Keep Nonce Lifespans Short: The default 12-hour lifespan is generally fine, but consider shortening it if you need extra security.
• Don’t Expose Nonces Unnecessarily: Avoid displaying nonces in visible parts of your page, as this can make them easier for attackers to steal. Always use hidden fields or AJAX requests to transmit nonces.
• Validate Nonces on the Server-Side: Never rely on client-side validation of nonces. Always verify them on the server before processing any data.
• Use HTTPS: HTTPS encrypts the communication between the user’s browser and your server, preventing attackers from intercepting the nonce.
• Regularly Update WordPress: WordPress updates often include security patches that address potential vulnerabilities related to nonce generation and verification.

In Conclusion: Nonces are Your Friends!

The wp_create_nonce() function and its associated functions are essential tools for securing your WordPress site against CSRF attacks. By understanding how these functions work and following best practices, you can significantly improve the security of your forms, AJAX requests, and other sensitive actions.

So, go forth and create nonces with confidence! Protect your pizza orders, your user data, and your peace of mind. And remember, a little bit of security goes a long way.

Now, if you’ll excuse me, I’m suddenly craving a pepperoni pizza. Good luck, and happy coding!