litespeedtech / litespeedtech/lscache_wp

ESI wp_rest nonce breaks Themeco Cornerstone editor

Open
#1,023 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
257
Forks
123
PR merge metrics
No merged PRs in 30d

Description

## Description

With **ESI enabled**, opening the Themeco Cornerstone editor (Pro theme or standalone) at `/cornerstone/` (or a custom app path) fails to load the builder UI.

LiteSpeed converts `wp_create_nonce( 'wp_rest' )` into an ESI block (predefined in `data/esi.nonces.txt`). Cornerstone runs on a **frontend** app route (not `wp-admin`), so that rewrite still applies. The ESI hole is then substituted with an HTML comment such as:

```html

```

or, when SSI processing fails:

```text
[an error occurred while processing this directive]
```

Those strings are injected into JavaScript produced by `wp_localize_script` / inline after-scripts, including:

- `wp.apiFetch.createNonceMiddleware( "..." )`
- `wpApiSettings.nonce`
- Cornerstone’s `csAppConfig.data.fetch.nonce`

That produces `Uncaught SyntaxError: Invalid or unexpected token`, and the browser renders the broken page as a wall of raw config/JSON text instead of the Cornerstone UI.

This is the same class of failure already handled for Elementor via `litespeed_disable_all` in editor context (`thirdparty/elementor.cls.php`). Cornerstone needs the equivalent treatment.

Disabling all plugins except Cornerstone (or disabling LiteSpeed / ESI) clears the issue.

## Steps to reproduce

1. Install LiteSpeed Cache on a LiteSpeed Enterprise (or QUIC.cloud) host with **ESI** enabled.
2. Activate Themeco Pro (or standalone Cornerstone) so `CS_VERSION` is defined.
3. Leave the default Cornerstone path (`/cornerstone`) or set a custom Path in Cornerstone settings.
4. Log in as a user who can edit with Cornerstone.
5. Visit `https://example.com/cornerstone/` (or the custom path).

## Expected behavior

Cornerstone’s React app loads normally. View source shows a normal 10-character REST nonce string in `wp-api-fetch-js-after` / `cs-app-js-extra`.

## Actual behavior

- Console: multiple `Uncaught SyntaxError: Invalid or unexpected token` on inline scripts (`wp-api-fetch-js-after`, `cs-app-js-extra`, `wp-api-request-js-extra`, etc.).
- Follow-on: `TypeError: Cannot read properties of undefined (reading 'data')` from `app.react18.*.js`.
- UI: blank/broken page filled with dumped JS config text.
- View source: REST nonce slots contain LiteSpeed “Block uncached…” comments or `[an error occurred while processing this directive]` instead of a nonce.

## Environment

- LiteSpeed Cache (ESI on; `wp_rest` in predefined ESI nonces)
- Themeco Pro / Cornerstone (editor at `/cornerstone/`)
- WordPress admin user session

## Suggested fix

Add a third-party integration (same pattern as Elementor) that calls `do_action( 'litespeed_disable_all', ... )` when:

1. `CS_VERSION` is defined, and
2. The request URI (or `HTTP_REFERER`) is the Cornerstone app path (`cornerstone` by default, or `custom_app_slug` from `cornerstone_settings`).

Do Not Cache URI alone is **not** sufficient: ESI nonce conversion still runs on uncached pages (page source can show “Block uncached by LiteSpeed Cache” *inside* the nonce string).

## Related

- PR: https://github.com/litespeedtech/lscache_wp/pull/1022
- Similar reports for other builders that put `wp_rest` inside `wp_localize_script` JSON (e.g. Bricks + ESI `wp_rest`)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with thirdparty/elementor.cls.php and the litespeed_disable_all action, then inspect CS_VERSION and cornerstone_settings handling for the request URI or HTTP_REFERER. Verify the Cornerstone app path no longer receives ESI-substituted wp_rest nonce content and that its editor loads with a normal nonce.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, php, react
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.