-
Notifications
You must be signed in to change notification settings - Fork 143
Description
Bug Description
WooCommerce has a mini-cart that appears in the header. It has an ✖️ button (actually a link) to remove an item from the cart. Unfortunately Speculative Loading's speculation rules are preloading/prefetching the URL, resulting in the product being removed unexpectedly:
Screen.recording.2024-04-15.12.54.28.webm
Steps to reproduce
- Configure WooCommerce with sample data
- Enable Speculative Loading
- Add a product to the cart (cf. Products added to cart in WooCommerce without clicking on Add to Cart button when Speculative Loading active #1140)
- Then click on the mini cart in the header and try hovering over the remove-from-cart button
Additional Context
Here is the source code for the remove-from-cart button: https://github.com/woocommerce/woocommerce/blob/a8e84d8c8b20558f66ed33dcbee6c1dec300752f/plugins/woocommerce/templates/cart/mini-cart.php#L46-L60
The wc_get_cart_remove_url() function, importantly, returns a URL that includes a _wpnonce (added via wp_nonce_url()). An example remove-from-cart link:
https://example.com/cart/?remove_item=1ff1de774005f8da13f42943881c655f&_wpnonce=cb065f29b3
The speculation rules used for the plugin should exclude URLs with _wpnonce by default. This was previously brought up in #733 (comment).