JS Nonce about antispam-bee

[swissspidy]

How safe is this? When you have a public route to get a nonce, what stops an attacker from fetching a nonce and populating a field with that nonce?

[websupporter]

Hi @swissspidy,
basically nothing, but they have to do it. So its another step, which needs to be taken. In the current PR, you need to know the public route and a nonce (wp_rest), so you would have to do some action, to get the correct nonce. But: This introduces a problem with cached pages right now and I think this PR needs some more thought.

Right now, it is not very high on my agenda. But I didn't want to close it, since this might be a feature, worth considering.

[websupporter]

wont fix for now.