fix: Store API tokenized cart nonce verification #8840
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Test the buildOption 1. Jetpack Beta
Option 2. Jurassic Ninja - available for logged-in A12s🚀 Launch a JN site with this branch 🚀 ℹ️ Install this Tampermonkey script to get more options. Build info:
Note: the build is updated when a new commit is pushed to this PR. |
|
Size Change: +11 B (0%) Total Size: 1.23 MB
ℹ️ View Unchanged
|
This was referenced May 17, 2024
mdmoore
approved these changes
May 23, 2024
6 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes proposed in this Pull Request
Here we realized some weird behavior with the tokenized cart PRBs when a block-based theme was used.
Every
POSTStore API request was throwing awoocommerce_rest_invalid_nonceerror code.It turns out that the behavior is due to this middleware, altering each Store API requests.
Checked in here with Team Rubik: p1715950599536899-slack-C02TS23QJ1X
They suggested we could skip nonce validations when a
Cart-Tokenheader is present ( woocommerce/woocommerce#42341 ).I am keeping the nonce validation, but instead overwriting the nonce on the server-side, before the request is processed.
Testing instructions
403error codes due to invalid noncesnpm run changelogto add a changelog file, choosepatchto leave it empty if the change is not significant. You can add multiple changelog files in one PR by running this command a few times.Post merge