This session picks up from the last preventing common security vulnerabilities session (https://wordpress.tv/2023/03/03/lets-code-preventing-common-security-vulnerabilities/), and cover's how to use nonces to prevent cross-site request forgery vulnerabilities

1. Jonathan Bossenger
Let’s Code
Learn.WordPress.org
Preventing CSRF Security Vulnerabilities

2. 2
👋🏽
Welcome!
As you join, please make sure you have your local
development environment ready:
• A local WordPress installation
• A code editor like VSCode or Sublime
• An insecure plugin
• https://github.com/jonathanbossenger/wp-
learn-plugin-security/releases/download/1.0.2-
beta/wp-learn-plugin-security.1.0.2-beta.zip
Then, let everyone know in the chat where you’re
joining us from…
Hello!
○ My name is Jonathan Bossenger
○ From Cape Town, South Africa
○ Developer educator at Automattic
○ Sponsored to work with the Training Team
○ jonathanbossenger.com

3. Learn.WordPress.org
Let's code!
Preventing CSRF
Security
Vulnerabilities
Jonathan Bossenger

4. Announcements
○ Welcome, and thanks for joining!
○ Please let me know if you can’t see this slide!
○ We are presenting in focus mode, but please feel free to enable your video.
○ You are welcome to ask questions.
○ You are welcome to post questions in the chat, or unmute to ask questions.

5. Announcements
○ Make sure your local install is ready
○ https://github.com/jonathanbossenger/wp-learn-plugin-
security/releases/download/1.0.2-beta/wp-learn-plugin-security.1.0.2-beta.zip
○ If I am going too fast, please let me know!
○ We will be posting this session to https://wordpress.tv/ afterwards
○ For more WordPress focused content please visit https://learn.wordpress.org/

6. Learning Outcomes
1. Recap vulnerabilities from previous session
• SQL Injection
• Cross Site Scripting (XSS)
• Broken Access Control
2. Preventing Cross-site Request Forgery (CSRF) vulnerabilities using nonces
• Adding nonces to forms, form submissions
• Adding nonces to async requests
3. Where to go to learn more

7. Objectives 1
1. Setup and review the insecure plugin
2. Recap the SQL injection prevention
3. Recap the XSS vulnerabilities
4. Recap the Broken Access Control vulnerabilities
5. Prevent any possible CSRF vulnerabilities
6. Find the bonus security vulnerability
7

8. 8
Let’s code.

9. Resources
○ https://github.com/jonathanbossenger/wp-learn-plugin-security/releases/download/1.0.2-
beta/wp-learn-plugin-security.1.0.2-beta.zip
○ https://developer.wordpress.org/plugins/security/
○ https://developer.wordpress.org/apis/security/
○ https://owasp.org/www-project-top-ten/
○ https://wordpress.tv/2023/03/03/lets-code-preventing-common-security-vulnerabilities/
○ https://portswigger.net/burp/communitydownload
○ https://developer.wordpress.org/apis/security/escaping/#escaping-with-localization
○ https://developer.wordpress.org/reference/functions/wp_nonce_field/

10. Resources
○ https://developer.wordpress.org/reference/functions/wp_verify_nonce/
○ https://developer.wordpress.org/reference/functions/wp_create_nonce/
○ https://developer.wordpress.org/reference/functions/check_ajax_referer/
○ https://developer.wordpress.org/reference/functions/wp_safe_redirect/