How do I disable nonce checking in a plugin?

I tried targeting WP Popular Posts endpoints to extend the nonce lifetime, but it didn’t work.

add_action('rest_api_init', function() {

    add_filter('rest_authentication_errors', function($errors) {

        $request_uri = $_SERVER['REQUEST_URI'] ?? '';

        $path = wp_parse_url($request_uri, PHP_URL_PATH);

        if ( strpos($path, 'wordpress-popular-posts/v2/') === false ) {

            return $errors; // 

        }

        add_filter('nonce_life', function($lifespan, $action) {

            if ($action === 'wp_rest') {

                return 365 * DAY_IN_SECONDS; 

            }

            return $lifespan;

        }, 10, 2);

        return $errors;

    }, 10); 

});

The crux of the problem is this: many posts on the site are evergreen, meaning there’s no point in regenerating the cache for them on a regular basis. In other words, the cache’s lifetime is infinite. This leads to the WPP nonce expiring. If you don’t use AJAX loading to display WPP, popular posts get cached as static content, meaning AJAX is necessary in any case.

My previous code really didn’t work for many reasons.

The solution is as follows. Remove the X-WP-Nonce header from the $_SERVER superglobal array for all REST requests to the wordpress-popular-posts/ namespace. WordPress will then not find the nonce and will not check it. Since the plugin’s endpoints are public (permission_callback => ‘__return_true’), they will work without a 403 error.

Why is this safe? WPP endpoints have permission_callback => ‘__return_true’, and they are public. The nonce is only needed for CSRF protection, which is not critical for public counters and widgets. No other REST endpoints are affected.

Here is the code:

add_action('rest_api_init', function() {
    $request_uri = $_SERVER['REQUEST_URI'] ?? '';
    if (strpos($request_uri, '/wordpress-popular-posts/') !== false) {
        unset($_SERVER['HTTP_X_WP_NONCE']);
  }
}, 1);

@hcabrera Wait a minute, do you have any other solution that you think would be safe?

Let me repeat: the reliance on a nonce forces the site to periodically regenerate the cache, even though this is often a very resource-intensive process. Imagine you have tens of thousands of posts that are never updated, but for the WPP to work correctly, it has to perform background preloading of them after a certain amount of time has passed.