# WordPress DiscourseConnect client - expired nonce

**URL:** https://meta.discourse.org/t/wordpress-discourseconnect-client-expired-nonce/285374
**Category:** WordPress
**Created:** [November 13, 2023, 7:09pm UTC](https://meta.discourse.org/t/wordpress-discourseconnect-client-expired-nonce/285374 "2023-11-13T19:09:59Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [November 14, 2023, 9:39am UTC](https://meta.discourse.org/t/wordpress-discourseconnect-client-expired-nonce/285374/5 "2023-11-14T09:39:51Z")

</div>

> [@angus](#):
>
> I’m a little unclear as to why this would clear Wordpress’ object cache

The problem isn’t with the WordPress object cache, as far as I know it’s not persistent across requests. The problem happens with sites that have some kind of persistent caching: [https://developer.wordpress.org/reference/classes/wp\_object\_cache/#persistent-caching](https://developer.wordpress.org/reference/classes/wp_object_cache/#persistent-caching). This can be configured through a plugin, but it’s also enabled by default by some hosting providers, for example WP Engine. I think for the case of WP Engine, they don’t enable the object cache on their login page, but they do enable it for anonymous users on all other pages. So on WP Engine the problem is only triggered if the “login with Discourse” link is added to a page other than the login page.

The problem with the `discourse_sso_url` is that when it’s always set to the same value, for sites that have a persistent cache enabled, it will always return the same nonce. Setting its `discourse_sso` value to a random string, instead of setting it to its default value of `1` breaks the cache. At least it’s always worked that way when I’ve tested it previously. I don’t have things configured to test it at the moment.

Edit: there are a few more details about the issue here: [Discourse (as provider) + WP SSO nonce error - #14 by simon](https://meta.discourse.org/t/discourse-as-provider-wp-sso-nonce-error/117113/14). It’s quite a while since I looked at this. The fix for the issue at the time seemed to be to _both_ add a random string to the `discourse_sso_url` and to ensure that page caching wasn’t enabled on the page the login link was displayed on (otherwise, the random string won’t be unique for each visit by an anonymous user.)

---

_[View the full topic](https://meta.discourse.org/t/wordpress-discourseconnect-client-expired-nonce/285374)._