litespeedtech / litespeedtech/lscache_wp
ESI wp_rest nonce breaks Themeco Cornerstone editor
- Dominant language
- PHP
- Stars
- 257
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
## Description
With **ESI enabled**, opening the Themeco Cornerstone editor (Pro theme or standalone) at `/cornerstone/` (or a custom app path) fails to load the builder UI.
LiteSpeed converts `wp_create_nonce( 'wp_rest' )` into an ESI block (predefined in `data/esi.nonces.txt`). Cornerstone runs on a **frontend** app route (not `wp-admin`), so that rewrite still applies. The ESI hole is then substituted with an HTML comment such as:
```html
```
or, when SSI processing fails:
```text
[an error occurred while processing this directive]
```
Those strings are injected into JavaScript produced by `wp_localize_script` / inline after-scripts, including:
- `wp.apiFetch.createNonceMiddleware( "..." )`
- `wpApiSettings.nonce`
- Cornerstone’s `csAppConfig.data.fetch.nonce`
That produces `Uncaught SyntaxError: Invalid or unexpected token`, and the browser renders the broken page as a wall of raw config/JSON text instead of the Cornerstone UI.
This is the same class of failure already handled for Elementor via `litespeed_disable_all` in editor context (`thirdparty/elementor.cls.php`). Cornerstone needs the equivalent treatment.
Disabling all plugins except Cornerstone (or disabling LiteSpeed / ESI) clears the issue.
## Steps to reproduce
1. Install LiteSpeed Cache on a LiteSpeed Enterprise (or QUIC.cloud) host with **ESI** enabled.
2. Activate Themeco Pro (or standalone Cornerstone) so `CS_VERSION` is defined.
3. Leave the default Cornerstone path (`/cornerstone`) or set a custom Path in Cornerstone settings.
4. Log in as a user who can edit with Cornerstone.
5. Visit `https://example.com/cornerstone/` (or the custom path).
## Expected behavior
Cornerstone’s React app loads normally. View source shows a normal 10-character REST nonce string in `wp-api-fetch-js-after` / `cs-app-js-extra`.
## Actual behavior
- Console: multiple `Uncaught SyntaxError: Invalid or unexpected token` on inline scripts (`wp-api-fetch-js-after`, `cs-app-js-extra`, `wp-api-request-js-extra`, etc.).
- Follow-on: `TypeError: Cannot read properties of undefined (reading 'data')` from `app.react18.*.js`.
- UI: blank/broken page filled with dumped JS config text.
- View source: REST nonce slots contain LiteSpeed “Block uncached…” comments or `[an error occurred while processing this directive]` instead of a nonce.
## Environment
- LiteSpeed Cache (ESI on; `wp_rest` in predefined ESI nonces)
- Themeco Pro / Cornerstone (editor at `/cornerstone/`)
- WordPress admin user session
## Suggested fix
Add a third-party integration (same pattern as Elementor) that calls `do_action( 'litespeed_disable_all', ... )` when:
1. `CS_VERSION` is defined, and
2. The request URI (or `HTTP_REFERER`) is the Cornerstone app path (`cornerstone` by default, or `custom_app_slug` from `cornerstone_settings`).
Do Not Cache URI alone is **not** sufficient: ESI nonce conversion still runs on uncached pages (page source can show “Block uncached by LiteSpeed Cache” *inside* the nonce string).
## Related
- PR: https://github.com/litespeedtech/lscache_wp/pull/1022
- Similar reports for other builders that put `wp_rest` inside `wp_localize_script` JSON (e.g. Bricks + ESI `wp_rest`)
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with thirdparty/elementor.cls.php and the litespeed_disable_all action, then inspect CS_VERSION and cornerstone_settings handling for the request URI or HTTP_REFERER. Verify the Cornerstone app path no longer receives ESI-substituted wp_rest nonce content and that its editor loads with a normal nonce.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, php, react
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100