Drop-in wp_create_nonce generates error for Rest API

[davidwebca]

I'm currently experiencing an issue with the drop-in wp_create_nonce function. There seems to be an error and there is JSON output alongside the nonce itself, but only when called through the rest api.

<input type="hidden" name="_nonce" value="e7c31b22b4{"code":"rest_missing_callback_param","message":"Param\u00e8tre(s) manquant(s)\u00a0: url","data":{"status":400,"params":["url"]}}" />

It's "missing parameter url" but in French. Can't figure out why, but only happens when ESI are activated and requesting the HTML output through a REST api endpoint. 🤔 It's as if the ESI back-and-forth didn't include all the params passed in the request back to the ESI include and that would be needed to fully work...

Did I mess up my config or is it really a bug? 🧐

[davidwebca]

I've continued to dig in and it seems to be related a similar issue as outline here: https://github.com/woocommerce/woocommerce/issues/23682#issuecomment-557630656

I'll see if continually switching my nonce with the one received in the headers of the Ajax call resolves the issue for me too.

Edit Mmm... I think, in the end, it's really the extra ESI round trip that's causing this. The plugin I'm using is echoing the nonce in the HTML that's returned by the rest API and that generates the error. 🤔