search

visiblevc / wordpress-starter

A slightly less shitty wordpress development workflow
688 stars 167 forks source link

Cookie nonce is invalid when posting/creating pages #156

Closed RichardWright closed 4 years ago

RichardWright commented 5 years ago

Overview

Failed to load resource: the server responded with a status of 403 (Forbidden) url - http://localhost:8080/wp-json/wp/v2/pages/12?_locale=use response body - [{"code":"json_cookie_invalid_nonce","message":"Cookie nonce is invalid"}]

api-fetch.min.js?ver=3.1.2:1 Uncaught (in promise) SyntaxError: Unexpected token < in JSON at position 0 at y (api-fetch.min.js?ver=3.1.2:1) at api-fetch.min.js?ver=3.1.2:1 at O (api-fetch.min.js?ver=3.1.2:1) at Generator._invoke (api-fetch.min.js?ver=3.1.2:1) at Generator.t. [as next] (api-fetch.min.js?ver=3.1.2:1) at n (api-fetch.min.js?ver=3.1.2:1) at u (api-fetch.min.js?ver=3.1.2:1)

It appears to be returning html instead of json.

docker-compose.yml

Project structure

-as per standard

docker-compose up output

Starting example_wordpress_1 ... Starting example_db_1 ... Starting example_phpmyadmin_1 ... done Attaching to example_wordpress_1 wordpress_1 | ====================================================================== wordpress_1 | Begin WordPress Installation
wordpress_1 | ====================================================================== wordpress_1 | ==> Downloading WordPress wordpress_1 | Downloading WordPress 5.1.1 (en_US)... wordpress_1 | md5 hash verified: ad6d229c6e485d084c77348d008f0612 wordpress_1 | Success: WordPress downloaded. wordpress_1 | ==> Waiting for MySQL to initialize... wordpress_1 | ==> Configuring WordPress wordpress_1 | Success: Generated 'wp-config.php' file. wordpress_1 | ==> Checking database wordpress_1 | Success: Database created. wordpress_1 | Success: WordPress installed successfully. wordpress_1 | ==> Checking themes wordpress_1 | Installing Twenty Nineteen (1.3) wordpress_1 | Downloading installation package from wordpress_1 | https://downloads.wordpress.org/theme/twentynineteen.1.3.zip. wordpress_1 | .. wordpress_1 | Unpacking the package... wordpress_1 | Installing the theme... wordpress_1 | Theme installed successfully. wordpress_1 | Success: Installed 1 of 1 themes. wordpress_1 | ==> Checking plugins wordpress_1 | Downloading installation package from wordpress_1 | https://github.com/WP-API/WP-API/archive/master.zip... wordpress_1 | Unpacking the package... wordpress_1 | Installing the plugin... wordpress_1 | Renamed Github-based project from 'WP-API-master' to wordpress_1 | 'WP-API'. wordpress_1 | Plugin installed successfully. wordpress_1 | Installing Academic Blogger's Toolkit (5.0.5) wordpress_1 | Downloading installation package from wordpress_1 | https://downloads.wordpress.org/plugin/academic-bloggers-tool wordpress_1 | kit.5.0.5.zip... wordpress_1 | Unpacking the package... wordpress_1 | Installing the plugin... wordpress_1 | Plugin installed successfully. wordpress_1 | Installing Co-Authors Plus (3.3.1) wordpress_1 | Downloading installation package from wordpress_1 | https://downloads.wordpress.org/plugin/co-authors-plus.3.3.1. wordpress_1 | zip... wordpress_1 | Unpacking the package... wordpress_1 | Installing the plugin... wordpress_1 | Plugin installed successfully. wordpress_1 | Success: Installed 3 of 3 plugins. wordpress_1 | ==> Finalizing wordpress_1 | Success: Rewrite rules flushed. wordpress_1 | Success: Rewrite structure set. wordpress_1 | ==> Executing user init scripts wordpress_1 | Warning: The 'my-plugin' plugin could not be found. wordpress_1 | Error: No plugins activated. wordpress_1 | ====================================================================== wordpress_1 | WordPress Configuration Complete!
wordpress_1 | ====================================================================== wordpress_1 | [Mon Apr 22 22:59:57.153141 2019] [mpm_prefork:notice] [pid 146] AH00163: Apache/2.4.25 (Debian) PHP/7.3.0 configured -- resuming normal operations wordpress_1 | [Mon Apr 22 22:59:57.153182 2019] [core:notice] [pid 146] AH00094: Command line: 'apache2 -D FOREGROUND' wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:04 +0000] "GET / HTTP/1.1" 200 4207 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /wp-includes/css/dist/block-library/theme.min.css?ver=5.1.1 HTTP/1.1" 200 778 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /wp-content/plugins/academic-bloggers-toolkit/bundle/frontend.css?ver=1555973989 HTTP/1.1" 200 1182 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /wp-includes/js/wp-embed.min.js?ver=5.1.1 HTTP/1.1" 200 1103 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /wp-includes/css/dist/block-library/style.min.css?ver=5.1.1 HTTP/1.1" 200 4595 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /wp-content/themes/twentynineteen/style.css?ver=1.3 HTTP/1.1" 200 30318 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /wp-includes/js/wp-emoji-release.min.js?ver=5.1.1 HTTP/1.1" 200 4739 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /wp-content/themes/twentynineteen/print.css?ver=1.3 HTTP/1.1" 200 1566 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 172.19.0.1 - - [22/Apr/2019:23:01:05 +0000] "GET /favicon.ico HTTP/1.1" 200 227 "http://localhost:8080/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36" wordpress_1 | 127.0.0.1 - - [22/Apr/2019:23:01:13 +0000] "OPTIONS HTTP/1.0" 200 126 "-" "Apache/2.4.25 (Debian) PHP/7.3.0 (internal dummy connection)" wordpress_1 | 127.0.0.1 - - [22/Apr/2019:23:01:14 +0000] "OPTIONS HTTP/1.0" 200 126 "-" "Apache/2.4.25 (Debian) PHP/7.3.0 (internal dummy connection)" wordpress_1 | ====================================================================== wordpress_1 | Begin WordPress Installation
wordpress_1 | ====================================================================== wordpress_1 | ==> Waiting for MySQL to initialize... wordpress_1 | ==> Configuring WordPress wordpress_1 | Success: Generated 'wp-config.php' file. wordpress_1 | ==> Checking database wordpress_1 | ==> Checking themes wordpress_1 | ==> Checking plugins wordpress_1 | ==> Finalizing wordpress_1 | Success: Rewrite rules flushed. wordpress_1 | Success: Rewrite structure set. wordpress_1 | ==> Executing user init scripts wordpress_1 | Warning: The 'my-plugin' plugin could not be found. wordpress_1 | Error: No plugins activated. wordpress_1 | ====================================================================== wordpress_1 | WordPress Configuration Complete!
wordpress_1 | ======================================================================

dsifford commented 5 years ago

This looks like an issue with the way you're calling the API.. did you provide a nonce? If using @wordpress/api-fetch, you still have to use the nonce middleware if your request requires a nonce.

RichardWright commented 5 years ago

This is out of the box. Totally standard.

I disabled the two plugins, updated the wp api one and it worked.

Sigh.

RichardWright commented 5 years ago

@dsifford btw thanks for this repo. It's fantastic work and I just wanted to acknowledge how much time you've saved me.

Too bad it's weird plugin model is still messing it up :(

dsifford commented 5 years ago

Which plugin is this issue showing up in? How can I reproduce?

RichardWright commented 5 years ago

It's not the plugin itself, it's just basic usage. Eg editing a page, editing a post. You can create but not save. Any of the ajax commands don't work. This is out of the box.

The plugins which disabling made it work - academic-bloggers-toolkit co-authors-plus

Plus upgrading wp-api

dsifford commented 5 years ago

There must be an issue somewhere in your configuration because I've been using this personally on dozens of sites of all shapes and sizes and have never had that issue.

dsifford commented 5 years ago

Also, you don't have to use ABT and coauthors-plus... Those are just examples of how to add plugins in your configuration.

The same is true with WP-API... I'm not even sure if that plugin still works. That was just an example of how to add a plugin from a github url

RichardWright commented 5 years ago

This is fresh out of github hence I opened the issue.

Isn't wp-api needed for ajax interactions? If that isn't enabled the site doesn't work surely? What's the alernative for that?

dsifford commented 5 years ago

wp-api has been included in WordPress core for some time now. IIRC around ~2 years

RichardWright commented 5 years ago

Oh odd. When disabled it. post editing failed with 404's. I was trying to work out why something so important was a plugin.

I'm no wordpress expert, if the functionality in the plugin is core, could it be removed from the template?

dsifford commented 5 years ago

The example page is meant to be read through and understood, not copy and pasted. It serves as a quick example of what a configuration might look like, covering several less common scenarios (e.g. all the ways you can specify plugin dependencies).

I'll leave the final judgement call on that to @karellm, but my choice would be to leave it as-is.

RichardWright commented 5 years ago

When I pull a project it should

1) Build 2) Function without modification once run 3) Use up to date dependencies 4) Use appropriate dependencies

I don't think these are unreasonable things to assume and would contribute to the usability of this project(which is very useful!). If wp-api is core, then it shouldn't be included. It's just confusing. As for the other two, the issues with those might be environmental and I would be keen to work out what.

codebymark commented 5 years ago

@RichardWright I was in the same boat. A quick update to WP REST API solved it