[wp-trac] [WordPress Trac] #53236: Nonce lifespans are inaccurate and unintuitively affected by timezones

[WordPress Trac]

#53236: Nonce lifespans are inaccurate and unintuitively affected by timezones
-------------------------------------------------+-------------------------
 Reporter:  lev0                                 |       Owner:  (none)
     Type:  defect (bug)                         |      Status:  new
 Priority:  normal                               |   Milestone:  Awaiting
                                                 |  Review
Component:  Date/Time                            |     Version:
 Severity:  minor                                |  Resolution:
 Keywords:  has-patch needs-testing needs-unit-  |     Focuses:
  tests                                          |
-------------------------------------------------+-------------------------

Comment (by Rarst):

 Ok, thank you! So in other words the justification for the change could be
 worded as "Should a minimum possible nonce life time be increased from
 effective current default of 12 hours?".

 As a component maintainer my conservative answer is no, I don't want extra
 code to deal with, in a legacy unused return, for a change that isn't a
 practical problem in the wild.

 The duration is filterable, so filtering `nonce_life` to two times desired
 minimum life time achieves it without code changes.

 Would be very interested in security perspective on this from someone
 qualified. WordPress nonces are already not a real nonces (which would
 only be used _once_), longer life time sounds _detrimental_ to their
 security function.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53236#comment:6>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform