Yet Another Expiration Issue Thread

[Jason LeMahieu (MadtownLems)]

Frankly, I never want these links to expire. Sometimes a draft page is being worked on for weeks, and getting feedback from someone. I don’t want to have to keep generating new links. I tried setting a 90 day expiration:

add_filter( ‘ppp_nonce_life’, ‘ext_network_functions_set_public_post_preview_nonce_life’ );

function ext_network_functions_set_public_post_preview_nonce_life( $lifetime ) {

    // 90 days

    return 7776000; // 90 * 24 * 60 * 60

}

Then I saved drafts of a Post, a Page, and a custom post type. The preview links worked for anonymous users as expected. 3 days later, only the Page one works now – with the others reporting they’re expired.

Looking through the forums and github, I see lots of issues with people having links “expire” prematurely.

Is it possible to just remove the concept of expiration all together? Any advice on helping troubleshoot why SOME links are expiring 88 days earlier?

Thank you!

[Christoph Bratschi]

Without the nonce check you would lose all security, the _ppp parameter being used uses a hash for the lifetime interval which cannot easily be guessed. You would have to create a random secret per post and store it in the database.

I reviewed the nonce tick calculation and here are definitely some issues with the expire times, they are not equal and the lifetimes are not obeyed. Like in wp_nonce_tick() (https://developer.ww.wp.xz.cn/reference/functions/wp_nonce_tick/) the guaranteed lifetime is half the used lifetime in the calculation. This fact is not mentioned in the documentation. Therefore if you define a lifetime of 60 days, it might expire already after 30 days. In practice this should not be an issue but you have to use a higher lifetime in practice or users will complain.

PS: the comments in verify_nonce() still mention the old 24h limit but it uses the given lifetime.