ESI predefined nonce wp_rest breaks JSON in wp_localize_script
-
Hi,
The
wp_restnonce is included in the predefined ESI nonces list (data/esi.nonces.txt). When a plugin outputs this nonce inside awp_localize_script()call, ESI replaces it with an HTML comment block — which breaks the entire JSON object and causes a JavaScript SyntaxError:js
var myData = {"restNonce":"<!-- Block cached by LiteSpeed Cache -->","otherKey":"value"} // Uncaught SyntaxError: Invalid or unexpected tokenThis affects any plugin/theme that embeds
wp_restnonce viawp_localize_script(e.g. Bricks Builder).The problem is that ESI replacement doesn’t distinguish between nonces in HTML context (safe to replace) and nonces inside JavaScript strings (breaks JSON parsing).
Suggestion: Could LiteSpeed detect when a nonce appears inside a
<script>tag /wp_localize_scriptoutput and either skip ESI replacement in that context, or use a JS-safe replacement instead of HTML comments?Currently the only workaround is removing
wp_restvia thelitespeed_esi_noncesfilter, which disables ESI for that nonce entirely.
You must be logged in to reply to this topic.