Hello @wildapache
Here is my understanding of the error and why it occured in the first place.
WordPress itself protects Ajax requests with a nonce, which is a security token. That token is generated partly from your login session, and your session lives inside the login cookie.
When the handler checks the nonce, it rebuilds the expected value from your current cookie and compares the two. If the cookie is stale or expired, the rebuilt value no longer matches, so you get the 400 bad request.
Clearing the cookies fixes it because it forces a fresh login, which creates a fresh session and fresh nonces that match again.
If it comes back for real visitors more than once, the usual suspect could be a caching plugin or CDN serving a page with an old nonce baked in. The fix there is to exclude Ajax pages from the cache.
I hope that explains it.
@lumiblog
Thank, now is more clear.
I need to test it more, to understand how to avoid this error in future.
I don’t want to appear this error at users, because after, they can’t log-in
Glad it is clearer.
For avoiding it with real users, the key thing to check is caching.
If you run a caching plugin or a CDN, make sure your login and Ajax pages are excluded from the cache. When a cached page carries an old nonce, a visitor with a different session gets the 400. Most caching plugins like already exclude wp-admin and wp-login by default, but it is worth confirming, and add any front-end page that fires Ajax.
I have a clear version of wordpress setup.
So no cache, cdn, plugins.
But, If possible to handle this error when user make a login, so we can try to clean user cookies !
