search

equalizedigital / accessibility-checker

GNU General Public License v2.0
15 stars 8 forks source link

Use wp nonce methods rather than custom ones in the validate flow #581

Open pattonwebz opened 4 months ago

pattonwebz commented 4 months ago

The validation flow used a custom-generated short-lived nonce to get the HTML content of draft or pending pages.

An actual WP nonce can be used instead here, which is what this PR swaps over to use.

The custom nonce was needed because the request didn't have any user context, but we can give it the user context so the wp nonce validates by forwarding the cookies in the request. Since this flow can only happen through a logged-in user that seems reasonable to me.

Closes: #580

SteveJonesDev commented 3 months ago

We ran into some complex issues with cookies not always passing properly maybe due to caching in some environments. Also, previously these scans could run on a schedule in the background adding to the complexity of passing user cookies. I'm going to table this for now and we'll revisit it.