# Nonce validation if user is logged in

**URL:** <https://community.gravityforms.com/t/nonce-validation-if-user-is-logged-in/14713>\
**Category:** Get Help\
**Tags:** security, nonce\
**Created:** [March 15, 2023, 1:53pm UTC](https://community.gravityforms.com/t/nonce-validation-if-user-is-logged-in/14713 "2023-03-15T13:53:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![user5ab22cd517e418.1](https://sea2.discourse-cdn.com/flex020/user_avatar/community.gravityforms.com/user5ab22cd517e418.1/32/1283_2.png) [@user5ab22cd517e418.1](https://community.gravityforms.com/u/user5ab22cd517e418.1)\
**Post date:** [March 15, 2023, 1:53pm UTC](https://community.gravityforms.com/t/nonce-validation-if-user-is-logged-in/14713/1 "2023-03-15T13:53:31Z")

</div>

We have forms that take different actions depending on whether or not they are submitted by a logged in user. The forms work perfectly except for one thing. I haven’t found a way to enable nonce validation just for logged in users. Has anyone found a way to achieve this? I’d prefer not having two identical forms with only a single setting (requireLogin) differing.

(The `gform_require_login` filter cannot be used since it isn’t affected by the user’s login state. Adding the gform\_require\_login filter through `gform_pre_render`, `gform_pre_validation` and `gform_pre_submission_filter` adds the necessary nonce but it doesn’t get validated on submission.)

> **[Security Best Practices](https://docs.gravityforms.com/security/#h-require-login)**
>
> The advice and best practices in this section is to help site owners and administrators to understand the issues and learn how to adjust the security features according to their needs.

---

<div class="post-metadata">

**Author:** ![user5ab22cd517e418.1](https://sea2.discourse-cdn.com/flex020/user_avatar/community.gravityforms.com/user5ab22cd517e418.1/32/1283_2.png) [@user5ab22cd517e418.1](https://community.gravityforms.com/u/user5ab22cd517e418.1)\
**Post date:** [March 15, 2023, 1:54pm UTC](https://community.gravityforms.com/t/nonce-validation-if-user-is-logged-in/14713/2 "2023-03-15T13:54:16Z")

</div>

Cross-posted in Facebook group: [Gravity Forms (and Certified Add-Ons) | Facebook](https://www.facebook.com/groups/gravityforms/posts/2332308870287625/).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/gravityforms1/original/2X/f/fef63f0599c45e0218c30d9f5d7ca8bff9b00189.png) [@system](https://community.gravityforms.com/u/system)\
**Post date:** [April 14, 2023, 1:54pm UTC](https://community.gravityforms.com/t/nonce-validation-if-user-is-logged-in/14713/3 "2023-04-14T13:54:59Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.