How to use nonces in a Wordpress multisite

Question

For a domain based multisite installation I have written some ajax endpoints to retrieve data from one blog of the network and display it in another blog of the same network.

I would had try wp_nonce_url and wp_verify_nonce but somehow, the nonces aren't indentical so the verification fails.

I wonder why this is so. As far as I could read from the docs of wordpress the nonce isn't bound to a domain, so it should be the same regardless which blog of the network I call.

Any hints what could be the reason, that the verification fails?

Answer 1

Ah, I got it.

I was logged in on the site which makes the ajax call and therefore uid and session were not identical. Because this information is used to build the hash it is obvious that the nonce could not match. Since I can not surely determine whether the user is logged into one of the affected blogs of the Ajax call (sender / recipient), I have no choice but to implement my own nonce routine.