title: How does check_ajax_referer() really work?
body: <p><a href="http://www.prelovac.com/vladimir/improving-security-in-wordpress-plugins-using-nonces" rel="noreferrer">Smart Wordpress people say</a> that plugin developers should employ a nonce in each AJAX request that is sent from a page back to the wordpress blog (admin-ajax.php).  </p>
  
  <p>This is done by (1) generating a nonce on the server side, via</p>
  
  <pre><code>$nonce = wp_create_nonce  ('my-nonce');
  </code></pre>
  
  <p>...(2) making that nonce available to Javascript code that sends AJAX requests. For example you could do it like this: </p>
  
  <pre><code>function myplg_emit_scriptblock() {
      $nonce = wp_create_nonce('myplg-nonce');
      echo "&lt;script type='text/javascript'&gt;\n" .
          " var WpPlgSettings = {\n" .
          "   ajaxurl : '" . admin_url( 'admin-ajax.php' ) . "',\n" .
          "   nonce : '" . $nonce . "'\n" .
          " };\n" .
          "&lt;/script&gt;\n";
  }
  add_action('wp_print_scripts','myplg_emit_scriptblock');
  </code></pre>
  
  <p>...and then (3) the javascript ajax logic references that global variable. </p>
  
  <pre><code>    var url = WpPlgSettings.ajaxurl +
          "?action=my-wp-plg-action&amp;" +
          "nonce=" + WpPlgSettings .nonce +
          "docid=" + id;
  
      $.ajax({type: "GET",
              url: url,
              headers : { "Accept" : 'application/json' },
              dataType: "json",
              cache: false,
              error: function (xhr, textStatus, errorThrown) {
                  ...
              },
              success: function (data, textStatus, xhr) {
                  ...
              }
             });
  </code></pre>
  
  <p>...and finally (4) checking the received nonce in the server-side logic. </p>
  
  <pre><code>add_action( 'wp_ajax_nopriv_skydrv-hotlink', 'myplg_handle_ajax_request' );
  add_action( 'wp_ajax_skydrv-hotlink', 'myplg_handle_ajax_request' );
  function myplg_handle_ajax_request() {
      check_ajax_referer( 'myplg-nonce', 'nonce' );  // &lt;&lt;=-----
      if (isset($_GET['docid'])) {
          $docid = $_GET['docid'];
          $response = myplg_generate_the_response($docid);
          header( "Content-Type: application/json" );
          echo json_encode( $response ) ;
      }
      else {
          $response = array("error" =&gt; "you must specify a docid parameter.");
          echo json_encode( $response ) ;
      }
  
      exit;
  }
  </code></pre>
  
  <p>But how does the check really work? </p>