Cache plugins and ajax nonce verification

Question

I created a plugin which use some ajax requests to load more posts on click. I noticed that when I use a cache plugin like W3 Total cache plugin then the wp_verify_nonce($nonce, $action) fail sometimes when I'm not loggin (since cache is disabled when loggin).

Because it's for a plugin, I must find a solution to solve this issue. Is there a way to make ajax request working with nonce verification and cache plugin. With W3 Total cache plugin even if I add some exception pages in Never cache the following pages it still cache the nonce values... but not the page itself. When the cache plugin is deactivated everything is working fine.

I spend days to try finding a solution but I didn't success. Even by adding constant, it still doesn't work (it's the same for fragment, html is not cached but nonce are cached) :

define('DONOTCACHEPAGE', true);
define('DONOTCACHEOBJECT', true);
define('DONOTCACHEDB', true);

I hope someone can help me with this issue because I spend so much days whithout success. By the way, the nonce is generated with wp_create_nonce and localize script as usual. And the nonce is verify with wp_verify_nonce.

Answer 1

basically you should not use nonce for non logged in users, and if you have to, then have page can not be cached otherwise users will think there is something wrong with the site. A middle ground is to have short time caching for like 1 minute but good luck with explaining that to most site owners, and it might make W3TC ineffective.